elastalert控制警报时间段

elastalert控制警报时间段
https://github.com/0xSeb/elastalert_hour_range

1、在elastalert_modules在增加hour_range_enhancement.py

import dateutil.parser

from elastalert.enhancements import BaseEnhancement
from elastalert.enhancements import DropMatchException

class HourRangeEnhancement(BaseEnhancement):
    def process(self, match):
        timestamp = None
        try:
            timestamp = dateutil.parser.parse(match['@timestamp']).time()
        except Exception:
            try:
                timestamp = dateutil.parser.parse(match['timestamp']).time()
            except Exception:
                pass
        if timestamp is not None:
            time_start = dateutil.parser.parse(self.rule['start_time']).time()
            time_end = dateutil.parser.parse(self.rule['end_time']).time()
            if(self.rule['drop_if'] == 'outside'):
                if timestamp < time_start or timestamp > time_end:
                    raise DropMatchException()
            elif(self.rule['drop_if'] == 'inside'):
                if timestamp >= time_start and timestamp <= time_end:
                    raise DropMatchException()

2、在rules的规则里增加以下

match_enhancements:
#时间转换为本地时区
  - "elastalert.enhancements.TimeEnhancement"
#控制报警时间段
  - "elastalert_modules.hour_range_enhancement.HourRangeEnhancement"

#警报时间控制
start_time: "4:00"
end_time: "20:00"