Elastalert没有通过Slack频道发出警报

编程问答 2022-08-14

问题描述

我正在使用Slack设置Elastalert警报系统。

这是Elastalert配置。

<section class="section-gallery">
<div class="gallery" id="anchor-gallery">
<img src="styles/Images/ananas.jpg" alt="">
<img src="styles/Images/jablko.jpg" alt="">
<img src="styles/Images/orange.jpg" alt="">
<img src="styles/Images/watermelon.jpg" alt="">
<img src="styles/Images/truskawa.jpg" alt="">
<img src="styles/Images/raspBerry.jpg" alt="">
<img src="styles/Images/avocado.jpg" alt="">
<img src="styles/Images/banan.jpg" alt="">
</div>

</section>


.section-gallery {
    height: 89vh;
    width: 100%;
    .gallery {
        display: grid;
        grid-template-columns:  1fr 1fr 1fr 1fr;
        grid-template-rows: 1fr 1fr;
        height: 89vh;
        width: 100%;
        img {
            width: 100%;
            height: 100%;
        }
    }
}

遇到错误

s_host: localhost
es_port: 9200
name: Slack rule
type: frequency
index: filebeat-*
num_events: 1
timeframe:
  minutes: 1
filter:
- term:
    msg: "proper name is required"
alert:
- "slack"
slack_webhook_url: "https://hooks.slack.com/services/SSDFRD/SddddS/XXXSDDDSddddDDDSS"
slack_channel_override: "#kibana"
slack_username_override: "@anand"

Elasticsearch记录

ERROR:root:Error finding recent pending alerts: RequestError(400,'search_phase_execution_exception','No mapping found for [alert_time] in order to sort on') 

{
   "query":{
      "bool":{
         "must":{
            "query_string":{
               "query":"!_exists_:aggregate_id AND alert_sent:false"
            }
         },"filter":{
            "range":{
               "alert_time":{
                  "from":"2020-08-25T13:33:31.764880Z","to":"2020-08-27T13:33:31.764901Z"
               }
            }
         }
      }
   },"sort":{
      "alert_time":{
         "order":"asc"
      }
   }
}

运行Elastalert服务后，我无法在Slack中收到警报消息。

请分享您的想法！

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）

elastalertelasticsearchfilebeatkibanapython