Awesome

elastalert-docker

elastalert docker images , this image include Wechat enterprise alerter plugin and Dingtalk alerter plugin

elastalert docker 镜像 并且开箱既用的集成了 微信企业号报警插件 和 钉钉报警插件(基于钉钉群机器人的webhook,支持签名安全认证，支持text和markdown格式)

Features(特性)

• Making everything available using environment variables. (通过环境变量进行构建和配置)

• Integration with the following external services via environment variables: (通过环境变量进行外部服务集成)

  • E-mail (General SMTP) (SMTP方式的email)
  • Exotel
  • Gitter
  • HipChat
  • JIRA
  • OpsGenie
  • PagerDuty
  • Slack
  • Telegram
  • Twilio
  • VictorOps
  • Wechat (微信企业号)
  • Dingtalk (钉钉群机器人)

• NTP syncrhonization and support change timezone. (同步NTP同步时间，并且支持修改时区)

• Startup check and install enhancement's and alerter's dependencies. (启动时检查和安装增强器和报警器的依赖pip包)

• Offset @timestamp to local time(Use timezone) (支持根据本地时区修改 @timestamp)

Usage(使用)

docker run -e"ELASTICSEARCH_HOST=es-host" \
    -e"CONTAINER_TIMEZONE=Asia/Shanghai"  \
    -e"TZ=Asia/Shanghai" \
    -e"ELASTALERT_DINGTALK_ACCESS_TOKEN=xxx" \
    -e"ELASTALERT_DINGTALK_SECURITY_TYPE=sign" \
    -e"ELASTALERT_DINGTALK_SECRET=xxx" \
    anjia0532/elastalert-docker:v0.2.4

demo rules(示例rules)

name: log-error
type: frequency
index: logstash-*
num_events: 20
timeframe:
    minutes: 5
filter:
- query:
    query_string:
      query: "level:ERROR"
      
compare_key:
- app_name
query_key:
- app_name

# 告警抑制
# 5 分钟内相同的报警不会重复发送
realert:
  minutes: 5

exponential_realert:
# 指数级扩大 realert 时间，中间如果有报警，
# 则按照 5 -> 10 -> 20 -> 40 -> 60 不断增大报警时间到制定的最大时间，
# 如果之后报警减少，则会慢慢恢复原始 realert 时间
exponential_realert:
  hours: 1

alert:
- "elastalert_modules.dingtalk_alert.DingTalkAlerter"
#- "elastalert_modules.wechat_qiye_alert.WeChatAlerter"

match_enhancements:
- "elastalert_enhancements.TimeEnhancement.TimeEnhancement"

alert_text_type: alert_text_only
alert_text: |
  从 {} 到 {} 产生了 {} 次 错误日志

  时间: {}

  模块: {}

  内容: {}

  堆栈: `{}`

alert_text_args:
  - local_starttime
  - local_endtime
  - num_hits
  - local_time
  - app_name
  - message
  - stack_trace

Environment Variables(环境变量)

Set at buildtime(构建时设置的变量)

These variables are set during the Docker build, and are generally necessary for running core functionality of Elastalert.

在构建镜像时设置的环境变量，是运行Elastalert所必须的

Set at runtime(启动时设置)

These variables are settings available in the Elastalert configuration file. Most of these settings apply to third-party integrations (JIRA, OpsGenie, etc), or are things documented here: Elastalert common configuration options

这些环境变量都是Elastalert 配置文件所需的，主要是通用配置和三方集成配置(Wechat,dingtalk等)

common configuration options(常用配置)

third-party integrations(三方集成)

Build(构建)

git clone https://github.com/anjia0532/elastalert-docker.git

cd elastalert-docker

docker build . -t anjia0532/elastalert-docker:v0.2.4 \ 
    [-t anjia0532/elastalert-docker:latest] [--build-arg ELASTALERT_VERSION=0.2.4] \
    [--build-arg MIRROR=true --build-arg ALPINE_HOST="mirrors.aliyun.com" --build-arg PIP_MIRROR="https://mirrors.aliyun.com/pypi/simple/"] 

Note:

• []: means optional
• ELASTALERT_VERSION: elastalert's version (ref https://github.com/Yelp/elastalert/releases) like v0.2.4 , v0.2.3 ...
• MIRROR: Whether to use alpine's mirror and pip's mirror (True/False) , when u switch true of this options, ALPINE_HOST(default mirrors.aliyun.com) and PIP_MIRROR(default is https://mirrors.aliyun.com/pypi/simple/) must be required
• ALPINE_HOST: alpine's mirror default is mirrors.aliyun.com
• PIP_MIRROR: pip's mirror default is https://mirrors.aliyun.com/pypi/simple/

注意:

• []: 意味着可选
• ELASTALERT_VERSION: 是elastalert的版本，详见 https://github.com/Yelp/elastalert/releases ，一般是 v0.2.4 v0.2.3 这样子
• MIRROR: 是bool值，构建时是否启用加速器，如果true则启用， 如果设置成true，ALPINE_HOST(默认mirrors.aliyun.com) 和 PIP_MIRROR(默认https://mirrors.aliyun.com/pypi/simple/) 必须不能为空，为空则使用默认值
• ALPINE_HOST: alpine 加速器地址，默认是阿里云 mirrors.aliyun.com
• PIP_MIRROR: pip 加速器地址，默认是阿里云 https://mirrors.aliyun.com/pypi/simple/

Thanks(鸣谢)

• elastalert part : Much of this repositiory was based off of the sc250024/docker-elastalert
• alerter part : Much of plugins(alerter and enhancements) was based off my repo anjia0532/elastalert-wechat-plugin

• elastalert部分: 大多是基于 sc250024/docker-elastalert 的项目，我从中学到了很多。
• 报警器部分: 报警器和增强器部分主要基于我另外一个项目 anjia0532/elastalert-wechat-plugin

Feedback(反馈)

welcome to commit new issues

有问题的话欢迎提交 新的 issues 来向我反馈

Copyright and License(版权和授权信息)

This module is licensed under the BSD license.

Copyright (C) 2020-, by AnJia anjia0532@gmail.com.

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.