elasticsearch

elastic_alert.md

elastalert Used for alert Elasticsearch Events:

Rules parameters

# (Required)
# Rule name, must be unique
name: Java Error application

type: frequency

index: stagemonitor-requests-*
num_events: 1
timeframe:
  minutes: 5
alert_on_new_data: True
filter:
  - term:
      error: "true"

alert:
  - email
  - slack

# email
smtp_host: "smtp.host.com"
smtp_port: "587"
smtp_auth_file: "smtp.auth.yml(contains user and password in yaml)"
email_reply_to: "reply.to@me.com"
from_addr: "from@me.com"
alert_subject: "Issue in {0} occurred at {1}"
alert_subject_args:
- application
- "@timestamp"

# Slack
slack_webhook_url: "https://hooks.slack.com/services/hukkcs"
slack_username_override: "Test_Watcher"
slack_channel_override: "#timepass"


email:
  - "send.email@to.com"