elasticalert

elastalert安装部署问题收集

官网文档：https://elastalert.readthedocs.io/en/latest/running_elastalert.html#tutorial

开始安装：

git clone https://github.com/Yelp/elastalert.git 
cd elastalert
  python setup.py install            
  pip install -r requirements.txt   
  {
      如果没有pip的话：
      pip安装：wget https://bootstrap.pypa.io/get-pip.py  
			  python get-pip.py  
  }
  cp config.yaml.example config.yaml

运行命令elastalert-test-rule测试规则时出现下面两个错误：

yaml.parser.ParserError: expected '<document start>', but found '<block mapping start>'
  in "rules/example_frequency.yaml", line 20, column 1

解决方法：注意配置行前面有空格

File "/usr/local/python3/lib/python3.8/site-packages/APScheduler-3.6.3-py3.8.egg/apscheduler/util.py", line 93, in astimezone
    raise TypeError('Only timezones from the pytz library are supported')
TypeError: Only timezones from the pytz library are supported

解决方法：将tzlocal的版本降到3.0以下，方法如下：

首先，查询官网的tzlocal的版本

很好。2.1，那就直接安装

pip install tzlocal

出现下面的情况，可以看到是tzlocal-3.0的

Requirement already satisfied: tzlocal in /usr/local/python3/lib/python3.8/site-packages/tzlocal-3.0b1-py3.8.egg (3.0b1)
Requirement already satisfied: backports.zoneinfo in /usr/local/python3/lib/python3.8/site-packages/backports.zoneinfo-0.2.1-py3.8-linux-x86_64.egg (from tzlocal) (0.2.1)

我的做法是先卸载掉现有的

# pip uninstall tzlocal
# Found existing installation: tzlocal 3.0b1
    Uninstalling tzlocal-3.0b1:
      Would remove:
        /usr/local/python3/lib/python3.8/site-packages/tzlocal-3.0b1-py3.8.egg
    Proceed (y/n)? y
      Successfully uninstalled tzlocal-3.0b1

OK，再安装

# pip install tzlocal
# Collecting tzlocal
  Using cached tzlocal-2.1-py2.py3-none-any.whl (16 kB)
    Requirement already satisfied: pytz in /usr/local/python3/lib/python3.8/site-packages (from tzlocal) (2017.3)
    Installing collected packages: tzlocal
    Successfully installed tzlocal-2.1

安装成功，再去运行elastalert-test-rule，great，不再报错了

安装elastalert插件，后面的目录一定写全

 /opt/elk/kibana-7.0.0-linux-x86_64/bin/kibana-plugin install file:///opt/elk/elastalert-kibana-plugin-1.0.4-7.0.0.zip

然而后续我没弄成功，等成功了再来补(早上还把kibana给弄挂了…)

启动命令

 nohup python3 -m elastalert.elastalert --verbose --rule rules/example_metric_aggregation.yaml --rule rules/example_frequency.yaml &