问题描述
任何人都可以帮助我在这种情况下创建警报 我有类似以下的日志事件
20200806 17:04:23.261 280018000 EV.WRN [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermkmID=f6y4j 的 TermRecord
20200806 17:04:23.261 280018000 EV.WRN [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermkmID=f6y4j 的 TermRecord
20200806 17:04:23.261 280018000 EV.INF [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermID=7yhe73v 的 TermRecord
20200806 17:04:23.261 280018000 EV.FNE [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermID=j6ljudn 的 TermRecord 这里 EV.WRN 是“event_type”,“无法加载 TermID=f6y4jkm 的 TermRecord”是 log_message。
如果使用相同的“log_message”获得相同的“event_type”,我想创建一个警报 具有相同的术语 ID。有没有办法根据这种情况生成和警报。以下是我当前的观察者脚本。
{
"trigger":{
"schedule":{
"interval":"10s"
}
},"input":{
"search":{
"request":{
"search_type":"query_then_fetch","indices":[
"testingalert*"
],"rest_total_hits_as_int":true,"body":{
"size":0,"query":{
"bool":{
"must":{
"query_string":{
"query":"Failed to load TermRecord for TermID=/a-zA-Z0-9_.-/"
}
},"filter":{
"range":{
"@timestamp":{
"gte":"{{ctx.trigger.scheduled_time}}||-5m","lte":"{{ctx.trigger.scheduled_time}}","format":"strict_date_optional_time||epoch_millis"
}
}
}
}
},"aggs":{
"log_message":{
"terms":{
"field":"log_message.keyword","size":10
},"aggs":{
"id":{
"terms":{
"field":"term_id.keyword","size":10
}
}
}
}
}
}
}
}
},"condition":{
"script":{
"source":"ArrayList arr = ctx.payload.aggregations.log_message.buckets; for (int i = 0; i < arr.length; i++) { if (arr[i].doc_count > params.threshold) { return true; } } return false;","lang":"painless","params":{
"threshold":2
}
}
},"actions":{
"send_email":{
"email":{
"profile":"standard","to":[
"redacted"
],"subject":"Watcher Notification","body":{
"text":"Watch [{{ctx.Metadata.name}}] The 'Terminal ID' alert has occured more than 5 times in 5 minutes interval of time"
}
}
}
},"transform":{
"script":{
"source":"HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.log_message.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i < arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i].doc_count; if (filteredHit.value > params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;","params":{
"threshold":2
}
}
}
}
解决方法
暂无找到可以解决该程序问题的有效方法,小编努力寻找整理中!
如果你已经找到好的解决方法,欢迎将解决方案带上本链接一起发送给小编。
小编邮箱:dio#foxmail.com (将#修改为@)