kibanna預設是沒有日誌報警等功能，本來想著yelp寫了個外掛elasticalert，但是配置檔案搞了半天也沒搞懂，看到kibana有個x-pack功能，體驗一下嘍。

　安裝

kibana

./bin/kibana-plugin install x-pack

elasticsearch

./bin/elasticsearch-plugin install x-pack

連線

地址： kibana地址:5601
賬號： elastic
密碼： changeme

欣賞

// 帶有monitor功能，可以看到延遲等資訊

// 說明，只能使用1個月哦

watcher

• 檢視當前watcher是否開啟

[root@t228 ~]# curl "http://elastic:[email protected]:9200/_xpack/watcher/stats"
{"watcher_state":"started","watch_count":0,"execution_thread_pool":{"queue_size":0,"max_size":0},"manually_stopped":false}[root@t228 ~]#

• 新增一個錯誤的watcher

[[email protected] ~]# curl -vX PUT http://elastic:
 
[email protected]:9200/_xpack/watcher/watch/errors_in_logs -d @error.json \
> --header "Content-Type: application/json"
* About to connect() to 192.168.3.228 port 9200 (#0)
*   Trying 192.168.3.228... connected
* Connected to 192.168.3.228 (192.168.3.228) port 9200 (#0)
* Server auth using Basic with user 'elastic'
 

> PUT /_xpack/watcher/watch/errors_in_logs HTTP/1.1
> Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 192.168.3.228:9200
> Accept: */*
> Content-Type: application/json
> Content-Length: 258
> 
< HTTP/1.1 201 Created
< content-type: application/json; charset=UTF-8
< content-length: 52
< 
* Connection #0 to host 192.168.3.228 left intact
* Closing connection #0
{"_id":"errors_in_logs","_version":1,"created":true}[[email protected] ~]#

# file: error.json

{
  "trigger" : {
    "schedule" : { "interval" : "10s" } 
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : [ "logs" ],
        "body" : {
          "query" : {
            "match" : { "message": "error" }
          }
        }
      }
    }
  }
}

• 再次檢視當前的watcher, count已經是1了。

[root@t228 ~]# curl "http://elastic:[email protected]:9200/_xpack/watcher/stats"
{"watcher_state":"started","watch_count":1,"execution_thread_pool":{"queue_size":0,"max_size":6},"manually_stopped":false}[root@t228 ~]# 

目前沒法向下走了， 研發人員和運維人員的腦袋雖然都是蛋白質，可是想法真不一樣，來個郵件報警不就得了，哎, doc裡面又是一堆put post， 然後還有contition啥的，太浪了。

參考：