0

我正在使用metricbeat-6.4.0, elasticsearch-6.4.0，elastalert-0.1.35 我想在任何进程时设置电子邮件警报，假设 notepad++.exe 已停止。

以下是我的规则： 

realert:  
minutes: 60  
from_addr: appmonProcess@company.com  
alert_text: "Dear User,\n\t notepad++.exe is not running on server IN-MUM-EADMTOOL for the last 15 minutes"  
es_host: linux-a2adm.in.company.com  
index: metricbeat-6.4.0-*  
smtp_host: ismtp.corp.company.com  
type: frequency  
es_port: 29200  
filter:  
term:  
beat.hostname: IN-MUM-EADMTOOL  
not:  
term:  
system.process.name: notepad++.exe  
timeframe:  
minutes: 15  
alert: email  
name: 93__server__IN-MUM-EADMTOOL__system.process.name__eqnotepad++.exe__1__15  
email: ["aviral.srivastava@company.com"]  
num_events: 1

我收到以下错误：

INFO:elastalert:Starting up WARNING:elasticsearch:GET http://linux-a2adm.in.company:29200/metricbeat-6.4.0-*/_search?_source_include=%40timestamp%2C%2A&ignore_unavailable=true&scroll=30s&size=10000 [status:400 request:0.035s] ERROR:root:Error running query: RequestError(400, u'parsing_exception', u'no [query] registered for [not]') INFO:elastalert:Ran 93__server__IN-MUM-EADMTOOL__system.process.name__eqnotepad++.exe__1__15 from 2018-11-09 17:18 India Standard Time to 2018-11-09 17:29 India Standard Time: 0 query hits (0 already seen), 0 matches, 0 alerts sent INFO:elastalert:Sleeping for 59.895 seconds

4

2 回答 2

0

对于 Elasticsearch 版本 > 5，此过滤器将无法编写将过滤器嵌入到and、not或关键字中的查询。相反，您可以使用查询键来编写完整的查询。

filter:
 - query:
      query_string:
        query: " beat.hostname: IN-MUM-EADMTOOL AND NOT system.process.name: notepad++.exe"

相关文档指出，您使用and之类的关键字编写的过滤器类型不仅适用于 Elasticsearch 2.X 或更早版本

于 2019-03-12T17:42:21.273 回答
0

过滤器问题，尝试使用：

filter:
-and:
 - term:
    beat.hostname: "IN-MUM-EADMTOOL"
 - not:
    term:
     system.process.name: "notepad++.exe"
于 2018-12-19T06:36:46.917 回答