1. 程式人生 > >x-pack watch郵件報警配置

x-pack watch郵件報警配置

郵件報警配置 type sim string last exchange pes str desc

參考網址:
https://www.cnblogs.com/reboot51/p/8328720.html
https://www.elastic.co/guide/en/x-pack/5.6/actions-email.html #郵件設置

elasticsearch 配置

xpack.notification.email.account:
    exchange_account:
        profile: outlook
        email_defaults:
            from: [email protected]
        smtp:
            auth: true
            starttls.enable: false
            host: smtpdm.aliyun.com
            port: 25
            user: [email protected]
            password: hkxxx2016

watcher 配置

1.syslog 數量監控

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "syslog-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "range": {
              "@timestamp": {
                "gt": "now-1m"
              }
            }
          },
          "sort": [
            {
              "@timestamp": {
                "order": "desc"
              }
            }
          ]
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "actions": {
    "email": {
      "throttle_period_in_millis": 60000,
      "email": {
        "profile": "outlook",
        "priority": "high",
        "to": [
          "[email protected]"
        ],
        "subject": "syslog 產生{{ctx.payload.hits.total}}條記錄 ",
        "body": {
          "html": "<html><h3>syslog索引 一分鐘內產生{{ctx.payload.hits.total}}條記錄,請註意查看</h3></html>"
        }
      }
    }
  }
}

2.elastic 狀態報警

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "http",
        "host": "10.25.234.176",
        "port": 9200,
        "method": "get",
        "path": "/_cluster/health",
        "params": {},
        "headers": {}
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.status": {
        "not_eq": "green"
      }
    }
  },
  "actions": {
    "email": {
      "throttle_period_in_millis": 60000,
      "email": {
        "profile": "outlook",
        "priority": "high",
        "to": [
          "[email protected]"
        ],
        "subject": "elasticsearch狀態為{{ctx.payload.status}},註意查看",
        "body": {
          "html": "<html><h3>elasticsearch狀態為{{ctx.payload.status}},註意查看!</h3></html>"
        }
      }
    }
  }
}

3.延時報警

{
  "trigger": {
    "schedule": {
      "cron": "0/30 * 1-6 ? * 2-6"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "simulation_adjust_job*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "task_accumulative_time_consuming:>3000"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gt": "now-30s"
                    }
                  }
                }
              ]
            }
          },
          "sort": [
            {
              "@timestamp": {
                "order": "desc"
              }
            }
          ]
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 3
      }
    }
  },
  "actions": {
    "email": {
      "throttle_period_in_millis": 60000,
      "email": {
        "profile": "outlook",
        "priority": "high",
        "to": [
          "[email protected]"
        ],
        "subject": "【嚴重】模擬交易成交時間",
        "body": {
          "html": "<html><h3>30s內成交時間超過3秒的有{{ctx.payload.hits.total}}條記錄,請註意查看!</h3></html>"
        }
      }
    }
  }
}

x-pack watch郵件報警配置