[elk]elastalert郵箱告警

本次要完成以下任務:

• 1.源碼包安裝elasticalert
• 2.配置郵箱報警

原則: 先很快的通過alert報警發一份郵件,其次了解alert配置文件各個選項

源碼安裝elasticalert

參考:
http://elastalert.readthedocs.io/en/latest/running_elastalert.html
http://www.voidcn.com/article/p-mmtjbhjp-mm.html
https://github.com/Yelp/elastalert

已適合elasticsearch5.x

git clone https://github.com/Yelp/elastalert.git; cd elastalert

yum install gcc libffi-devel python-devel openssl-devel -y
pip install cryptography

pip install "setuptools>=11.3"  ## 這里默認你已yum install python-pip並將源指向了aliyun.
python setup.py install

配置郵箱驗證

• 配置郵箱用戶名密碼

$ cat /usr/local/elastalert/example_rules/email_auth.yaml
user: [e-mail]
password: 123456

• 修改配置alert配置文件

$ cat example_rules/rule.yaml 
es_host: 192.168.x.x
es_port: 9200
name: For A TEST
use_strftine_index: true
type: frequency
index: filebeat-*
num_events: 1
timeframe:
  hours: 1

#filter:
# - query:
# query_string:
# query: "@message: *nioEventLoopGroup*"

filter:
- query_string: 
    query: "message: 測試一下下"

alert:
    - "email"
email:
    - "[e-mail]"
    - "[e-mail]"
    
smtp_host: smtp.sina.com
smtp_port: 25
smtp_ssl: false
smtp_auth_file: /usr/local/elastalert/example_rules/email_auth.yaml
from_addr: [e-mail]

啟動elasticalert測試

python -m elastalert.elastalert --verbose --rule example_rules/rule.yaml  #啟動后會自動創建一個elastalert_status的索引.

elk測試環境搭建

• 安裝filebeat
• 安裝es
• 配置filebeat
• 啟動es,filebeat,elasticalert

參考:https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html

filebeat監控文件,並且向文件里寫入內容
確保es能收到.在kibana里觀察索引搜到的內容.

$ cat filebeat.yml 
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /tmp/a.txt

output.elasticsearch:
    hosts: ["http://192.168.x.x:9200"]
    setup.dashboards.enabled: true
    template.enabled: true
    template.path: "filebeat.template.json"
    template.overwrite: true

output.console:
  pretty: true

dashboards.enabled: true

$ cat /tmp/a.txt 
測試一下下
測試一下下
測試一下下
測試一下下

查看kibana

查看郵箱-已收到

alert還有kibana插件,以及elasticalert還可以容器方式啟動

參考:
https://github.com/bitsensor/elastalert-kibana-plugin
插件下載慢:

https://git.bitsensor.io/front-end/elastalert-kibana-plugin/-/jobs/10874/artifacts/raw/artifact/elastalert-5.6.4-latest.zip
然后
./bin/kibana-plugin install file:///usr/local/src/elastalert-5.6.4-latest.zip

安裝后效果:

微信報警：https://github.com/anjia0532/elastalert-wechat-plugin
釘釘報警：https://github.com/xuyaoqiang/elastalert-dingtalk-plugin

告警規則
告警模板
告警時間
告警方式

參考:https://xizhibei.github.io/2017/11/19/alerting-with-elastalert/

https://github.com/chenryn/ELKstack-guide-cn/blob/master/elasticsearch/other/elastalert.md