java邮件预警,elk 7.0 邮件预警

{

"trigger": {

"schedule": {

"cron": "0/15 * * * * ?"

}

},

"input": {

"search": {

"request": {

"search_type": "query_then_fetch",

"indices": [

"heartbeat*"

],

"rest_total_hits_as_int": true,

"body": {

"size": 1,

"query": {

"bool": {

"must": [

{

"match": {

"monitor.status": "down"

}

}

],

"filter": {

"range": {

"@timestamp": {

"from": "{{ctx.trigger.triggered_time}}||-10m",

"to": "{{ctx.trigger.triggered_time}}"

}

}

}

}

}

}

}

}

},

"condition": {

"compare": {

"ctx.payload.hits.total": {

"gt": 0

}

}

},

"actions": {

"email_admin": {

"email": {

"profile": "standard",

"to": [

"zhangsan@com.net.cn"

],

"subject": " [{{ctx.metadata.name}}] 预警",

"body": {

"text": "ip地址：{{ctx.payload.hits.hits.0._source.url.domain}}。\r\n端口：{{ctx.payload.hits.hits.0._source.url.port}} 。\r\n地址：{{ctx.payload.hits.hits.0._source.url.full}}。\r\n时间：{{ctx.payload.hits.hits.0._source.@timestamp}}。\r\n错误：{{ctx.payload.hits.hits.0._source.error.message}}\r\n详情：{{ctx.payload.hits.hits.0._source}}"

}

}

}

}

}