您可以使用商业产品
Watcher,并定义以下监视器:
PUT _watcher/watch/transaction_alert
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"indices": "transactions",
"types": "transaction",
"body": {
"query": {
"match_all": {}
},
"size": 0,
"aggs": {
"groupBy": {
"terms": {
"field": "CustomerName"
},
"aggs": {
"points_sum": {
"stats": {
"field": "TransactionAmount"
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"inline": "return ctx.payload.aggregations.groupBy.buckets.findAll{ cust -> cust.points_sum.avg >= 200}"
}
},
"actions": {
"send_email": {
"email": {
"to": "<username>@<domainname>",
"subject": "Customer Notification - Transaction > 200",
"body": "The attached customers have a transaction average above $200"
"attachments" : {
"data.yml" : {
"data" : {
"format" : "yaml"
}
}
}
}
}
}
}
更新
总的来说:
- Watcher是一款商业产品。
- ElastAlert目前还不支持它,并且需要一些努力才能让它工作。可以点击此处了解详情。
还有另一种更简单、更便宜的方法,可以使用Logstash实现这一点。尽管elasticsearch
输入插件不支持聚合,但可以使用http_poller
输入插件定期向Elasticsearch发送聚合查询。然后使用过滤器检查是否达到所需的阈值,最后使用email
输出插件向某人发送警报邮件(如果情况成立)。
配置基本上如下所示(请注意,上面的聚合查询需要进行URL编码,并使用source=...
参数将其发送到ES中)。还请注意,我修改了您的查询以根据points_sum.avg
(降序)对存储桶进行排序。
input {
http_poller {
urls => {
test1 => 'http://localhost:9200/your-index/_search?source=%7B%22query%22%3A%7B%22match_all%22%3A%7B%7D%7D%2C%22aggs%22%3A%7B%22groupBy%22%3A%7B%22terms%22%3A%7B%22field%22%3A%22CustomerName%22%2C%22order%22%3A%7B%22points_sum.avg%22%3A%22desc%22%7D%7D%2C%22aggs%22%3A%7B%22points_sum%22%3A%7B%22stats%22%3A%7B%22field%22%3A%22TransactionAmount%22%7D%7D%7D%7D%7D%2C%22size%22%3A0%7D'
}
interval => 10
codec => "json"
}
}
filter {
split {
field => "[aggregations][groupBy][buckets]"
}
}
output {
if [aggregations][groupBy][buckets][points_sum][avg] > 200 {
email {
to => "<username>@<domainname>"
subject => "Customer Notification - Transaction > 200",
body => "The customer %{[aggregations][groupBy][buckets][key]} has a transaction average above $200"
}
}
}
同意,这是一种非常简单的实现方式,但它应该可以工作,你可以在其基础上构建更智能的实现方式,结合 Logstash 和你的想象力,只有天空是极限;-)
更新2
还有另一个名为elasticwatch的 node.js 工具也可以被利用来完成这个任务。