2018-08-01 10:03:18 +02:00
|
|
|
ElastAlert
|
|
|
|
|
==========
|
|
|
|
|
|
2019-07-17 05:56:47 +02:00
|
|
|
[ElastAlert][1] is a simple framework for alerting on anomalies, spikes, or other
|
|
|
|
|
patterns of interest from data in Elasticsearch.
|
|
|
|
|
|
|
|
|
|
## up and running
|
2018-08-01 10:03:18 +02:00
|
|
|
|
|
|
|
|
```bash
|
2019-10-30 12:57:53 +02:00
|
|
|
$ docker-compose run --rm elastalert sh
|
|
|
|
|
>>> elastalert-create-index --config config.yaml
|
|
|
|
|
>>> elastalert-test-rule --config config.yaml rules/example.yaml
|
2018-08-01 10:03:18 +02:00
|
|
|
>>> exit
|
2019-10-30 14:04:37 +02:00
|
|
|
|
2019-10-30 12:57:53 +02:00
|
|
|
$ docker-compose up -d
|
2019-10-30 14:04:37 +02:00
|
|
|
|
|
|
|
|
$ docker-compose logs -tf
|
|
|
|
|
elastalert_1 | 2019-10-30T10:33:31.960452334Z bad things happend
|
|
|
|
|
elastalert_1 | 2019-10-30T10:42:27.952772739Z bad things happend
|
|
|
|
|
elastalert_1 | 2019-10-30T10:50:22.808460534Z bad things happend
|
2018-08-01 10:03:18 +02:00
|
|
|
```
|
2019-07-17 05:56:47 +02:00
|
|
|
|
|
|
|
|
> ElastAlert will also load new rules, stop running missing rules, and restart
|
|
|
|
|
> modified rules as the files in this folder change.
|
|
|
|
|
|
|
|
|
|
[1]: http://elastalert.readthedocs.io/en/latest/
|
