在我们的 ES 中，我们为定期搜索的几个索引设置了别名。涵盖的索引之一包含我们的 DNS 日志。
如果我在 Kibana 或 ES 中搜索：
查询：www.testbad.domain
无论我是在别名索引中还是在 DNS 索引中搜索，我都能获得成功。
所以我创建了以下规则：
# Test alert to check function
use_ssl: False
es_username: me
es_password: 12345
type: blacklist
- "www.testbad.domain"
- "!file /opt/elastalert/black_lists/bad_domains.txt"
index: alias-*
name: Detect-bad-domains
compare_key: Query
ignore_null: true
alert:
- command
command: send_alert.sh
但是当我测试警报时，我得到以下信息：
Successfully loaded Detect-bad-domains
Got 12345325 hits from the last 1 day
Available terms in first hit: <list of terms which does NOT include Query>
Warning: compare key %s is either missing or null!
Included term Query may be missing or null
Traceback (most recent call last):
File "/usr/bin/elastalert-test-rule", line 11 in <module>
load_entry_point('elastalert==0.1.29', 'console_scripts','elastalert-test-rule')()
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 378, in main
test_instance.run_rule_test()
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 373, in run_rule_test
self.run_elastalert(rule_yaml, conf, args_
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 211, in run_elastalert
load_modules(rule, load_modules_args)
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/config.py", line 341, in load_modules
rule['type']=get_module(rule['type'])
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/config.py", line 100, in get_module
base_module = __import__(module_path, globals(), locals(), [module_class])
elastalert.util.EAException:
Could not import module blacklist: - "www.testbad.domain": No module named blacklist = "www.testbad
如果我从 type: blacklist 下的列表中删除值 www.testbad.domain，我会得到一个不同的回溯错误：
Traceback (most recent call last):
File "/usr/bin/elastalert-test-rule", line 11 in <module>
load_entry_point('elastalert==0.1.29', 'console_scripts','elastalert-test-rule')()
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 378, in main
test_instance.run_rule_test()
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 357, in run_rule_test
rule_yaml=load_rule_yaml(arg.file)
File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/config.py", line 128, in load_rule_yaml
loaded = yaml_loader(filename)
File "build/bdist.linux-x86_64/egg/staticconf/loader.py",line 93, in yaml_loader
File "/usr/lib64/python2.7/site-packages/yaml/__init__.py", line 71, in load return
loader.get_single_data()
File "/usr/lib64/python2.7/site-packages/yaml/constructor.py", line 37, in get_single_data
node = self.get_single_node()
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 36, in get_single_node
document = self.compose_document()
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 55, in compose_document
node = self.compose_document(None, None)
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 127, in compose_mapping_node
while not self.check_event(MappingEndEvent):
File "/usr/lib64/python2.7/site-packages/yaml/parser.py", line 98, in check_event
self.current_event = self.state()
File "/usr/lib64/python2.7/site-packages/yaml/parser.py", line 439, in parse_block_mapping_key
"expected <block end>, but found %r" % token.id, token.start_mark)
yaml.parser.ParserError: while parsing a block mapping
in "test-detect.yaml", line 3, column 1
expected <block end, but found '<block sequence start>'
in "test-detect.yaml", line 10, column 5
然后我尝试更改为键入任何内容并指定查询。
type: any
filter:
- query:
query_string:
query: "Query: www.testbad.domain"
这没有产生任何结果，但“查询”列在“第一次命中的可用条款”中
所以我尝试了：查询：“查询：*www.testbad.domain*”。仍然没有命中。
然后我尝试了：查询：“查询：*testbad*”。现在我得到了打击。
（我无法正确显示，但两个查询都应该被星号包围，没有空格）
所以我的问题是：
- 黑名单搜索是怎么回事？为什么python会出错？
- 为什么在查询字符串的特定索引中搜索 FQDN 时没有命中？
- 为什么 Query 没有列为我可以使用别名搜索的字段？