elastcialert的使用

告警规则示例

name: cpu
type: frequency
index: metricbeat-*
#匹配到关键字次数超过2次才告警
num_events: 2
timeframe:
minutes: 5
#5分钟内相同的告警的不会发送
realert:
minutes: 5
filter:

• query:
  query_string:
  query: “system.cpu.cores: > 2”
  alert:
• “post”
  http_post_url: “http://192.168.90.11:8000/v1”
  http_post_static_payload:
  rule_name: any_rule
  rule_level: medium

---

name: any
type: any
index: metricbeat-*
timeframe:
minutes: 1
filter:

• range:
  system.cpu.cores:
  gte: 5
  lte: 7
  #post接口推送数据
  alert:
• “post”
  http_post_url: “http://192.168.90.11:8000/v1”
  #post定义输出的内容，对应elasticsearch的索引的k,v
  http_post_payload:
  ip: clinet

---

name: cpu
type: frequency
index: metricbeat-*
num_events: 2
timeframe:
minutes: 5
filter: