2019-02-19

Elastalert 插件安装

参考：https://elastalert.readthedocs.io/en/latest/running_elastalert.html

安装 pip

$ wget https://bootstrap.pypa.io/get-pip.py

$ python get-pip.py

下载模块

$ pip install "setuptools>=11.3"

$ python setup.py install

通过 git 安装或者 pip 安装

$ cd /usr/local/

$ git clone https://github.com/Yelp/elastalert.git

Elasticsearch 6.3:

$ pip install "elasticsearch>=6.3.1"

创建索引：

$ /usr/local/elastalert master elastalert-create-index

Elastic Version:6

Mapping used for string:{'type': 'keyword'}

Index elastalert_status already exists. Skipping index creation.

在这可以发现索引已经有了，查看一下索引：

curl 'localhost:9200/_cat/indices?v'

health status index          uuid    pri rep docs.count docs.deleted store.size pri.store.size

yellow open elastalert_status  fR_R5bOGSqCFS6ezK2RMNA  5  1  0  0    1.2kb  1.2kb

出现了一个错误：

yaml.parser.ParserError: while parsing a block mapping

  in "example_rules/example_frequency.yaml", line 20, column 1

did not find expected key

  in "example_rules/example_frequency.yaml", line 46, column 2

是因为example_frequency.yaml 里添加的 SMTP 配置前面有空格，yaml 一定要注意空格的问题！

image

image