search

Yelp / elastalert

Easy & Flexible Alerting With ElasticSearch
https://elastalert.readthedocs.org
Apache License 2.0
7.99k stars 1.74k forks source link

Flatline rule to send an alert #2667

Open deepthitummala opened 4 years ago

deepthitummala commented 4 years ago

Hi, Can anyone help me on this...? I am trying to send alert when anyone of our 4 AKS clusters doesn't send data to elasticsearch with the specific cluster name. Each and every cluster send its data with specific index name. We need to filter all the indices and check which index is not sending data in specific timeframe and trigger the alert with that index name.

daichi703n commented 4 years ago

flatline mathes your case. Note that latest ElastAlert seems not to be full compatible with Elasticsearch7.x schema... flatline with option use_count_query, doc_type does not work because doc_type (_types on ES) is removed and query succeed but result is unexpected. Which version are you using? (ElastAlert, Elasticsearch)

FYI, you can debug ES query with using --es_debug_trace trace.log startup option.