kibana-sentinl-监控报警

kibana 安装 sentin 插件

./bin/kibana-plugin install https://github.com/sirensolutions/sentinl/releases/download/tag-6.2.3-2/sentinl-v6.2.3.zip  # 根据实际情况下载对应kibana版本的插件

重启kibana

添加发件邮箱

vim /etc/kibana/kibana.yml

sentinl:
  settings:
    email:
      active: true
      user: xxx@163.com
      password: mima
      host: smtp.163.com
      ssl: true   #根据实际情况添加
    report:
      active: true

添加报警规则：

{
  "_index": "watcher",
  "_type": "watch",
  "_id": "new_watcher_bzd9kgjzi",
  "_score": 1,
  "_source": {
    "title": "Alerm",
    "disable": false,
    "uuid": "new_watcher_bzd9kgjzi",
    "trigger": {
      "schedule": {
        "later": "every 1 hours"  //执行时间为1小时
      }
    },
    "input": {
      "search": {
        "request": {
          "body": {
            "query": {
              "bool": {
                "must": [
                  {
                    "query_string": {
                      "fields": [
                        "body^5",
                        "_all"
                      ],
                      "query": "ERROR~",  //限制报警源为出错ERROR的日志
                      "use_dis_max": true
                    }
                  },
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1h",  //对进1小时的日志进行检测
                        "lte": "now",
                        "format": "epoch_millis"
                      }
                    }
                  }
                ],
                "must_not": []
              }
            }
          }
        }
      }
    },
    "condition": {
      "script": {
        "script": "payload.hits.total>=1"  //当报警条件为ERROR出现的次数大于1
      }
    },
    "transform": {
      "script": {
        "script": ""
      }
    },
    "actions": {
      "AlermNeon": {
        "throttle_period": "1h0m0s",
        "email": {
          "to": "yyyg@163.com",  //接收报警的邮箱
          "from": "xxxx@163.com",//发送报警的邮箱（与kibana.yml配置中一致）
          "subject": "Sentinl Alarm",
          "priority": "high",
          "body": "Alerm of neon: {{payload.hits.total}} !"  //邮件内容
        }
      }
    }
  }
}  

查看kibana 日志，看有没有异常报错： tail -f /var/log/kibana/kibana.stdout

参考链接：

　https://blog.csdn.net/whg18526080015/article/details/73812400

　http://blog.51cto.com/10546390/2051676