ElastAlert不工作

Question

我正试图在elastAlert上制定一个规则。

Config.yaml

rules_folder: example_rules


run_every:
  minutes: 1


buffer_time:
  minutes: 1


es_host: localhost


es_port: 9200


writeback_index: elastalert_status

alert_time_limit:
  days: 2

示例_rules/示例_Frequency.yaml：

 name: Example rule


 type: frequency


 index: sample



 num_events: 1


 timeframe:
    hours: 4 


 filter:
 - term:
     message: "hi"


 alert:
 - "email"


 email:
 - "abc@example.com"

当我这么做时：

GET sample/_search?q=*

我得到：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 4,
    "max_score": 1,
    "hits": [
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "2",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:32:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "4",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T12:15:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "1",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:25:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "3",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:45:00",
          "message": "hi"
        }
      }
    ]
  }
}

但是当我做python -m elastalert.elastalert --verbose --rule example_frequency.yaml的时候，我得到了这个：

    INFO:elastalert:Starting up
    INFO:elastalert:Queried rule Example rule from 2016-05-27 17:43 IST to 2016-05-27 17:44 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:43 IST to 2016-05-27 17:44 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
   INFO:elastalert:Queried rule Example rule from 2016-05-27 17:44 IST to 2016-05-27 17:45 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:44 IST to 2016-05-27 17:45 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
  INFO:elastalert:Queried rule Example rule from 2016-05-27 17:45 IST to 2016-05-27 17:46 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:45 IST to 2016-05-27 17:46 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
  INFO:elastalert:Queried rule Example rule from 2016-05-27 17:46 IST to 2016-05-27 17:47 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:46 IST to 2016-05-27 17:47 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds

为什么不起作用？它显示命中查询为0。但为什么我不明白。

Answer 1

使用"--es_debug_trace“可以提供帮助，如下所示

python -m elastalert.elastalert --verbose --rule example_frequency.yaml --es_debug_trace /opt/elastalert/runtime.log

这可以帮助您查看被激发的实际cURL命令以获得命中次数。在这里，可以查看用于搜索筛选器/查询/匹配的日期/时间范围。

在您的示例中，问题是@Val在注释中提到的日期(IST和UTC)。

Answer 2

您需要在您的规则中配置时间戳(样例_规则/示例_频数)

timestamp_field: "@timestamp"

而且很有可能：

timestamp_type

timestamp_format

-> 文档

此外，在您的示例中，使用这些配置将获得最佳性能：

use_count_query: true

doc_type: blog

-> 文档