来看个小例子:固定周期采集数据,并设置数据预警机制
采集数据配置,拉取RSS数据并存储到ElasticSearch中.
1.下载并安装最新的logstash1.5版本
地址:https://www.elastic.co/products/logstash
2.安装rss插件
cd logstash-1.5.0 bin/plugin install logstash-input-rss
3.配置数据采集脚本
input { rss { url => "http://stackoverflow.com/feeds/tag/elasticsearch+or+logstash+or+kibana" interval => 3600 } } output { elasticsearch { protocol => "http" host => "localhost" } stdout { } }
4.启动logstash
nohup bin/logstash -f rss.conf > logs/rss.log&
5.验证ElasticSearch数据流是否正常
可以通过API,或者Kopf,Head等插件进行验证。
Watcher预警配置
1.首先定义Script文件,采用Groovy语法,将文件放置到$ES_HOME/config/Scripts目录下。
$ES_HOME/config/scripts/threshold_hits.groovy 编辑内容为: return ctx.payload.hits.total > threshold
2.设置Watcher:
PUT _watcher/watch/rss_watch { "trigger" : { "schedule" : { "daily" : { "at" : "12:00" } #每天12点执行 } }, "input" : { "search" : { "request" : { "indices" : [ "logstash*" ],#指定查询索引 "body" : { "query" : { "filtered" : { "query" : {"match" : {"message": "error problem"}}, #查询条件 "filter" : {"range" : {"@timestamp" : {"gte" : "now-1d"}}} } } } } } }, "condition" : { "script" : { "file" : "threshold_hits",#脚本文件名称 "params" : { "threshold" : 0 #参数 } } }, "actions" : { "send_email" : { #请注意ElasticSearch.yml中的邮件服务器配置信息,可参考之前的文章介绍 "email" : { "to" : "corejava2008@163.com", "subject" : "Somebody needs help with ELK", "body" : "The attached Stack Overflow posts were tagged with Elasticsearch, Logstash, or Kibana and mentioned an error or problem.", "attach_data" : true } } } }
3.调试Watcher配,通过以下API可以,立刻执行配置的Watcher
POST _watcher/watch/rss_watch/_execute { "trigger_event" : { "schedule" : { "triggered_time": "now", "scheduled_time": "now" } }, "ignore_throttle" : true, "simulated_actions" : "_all", "record_execution" : true }
4.验证是否可以收到预警邮件。
相关推荐
elasticsearch-head-compile-after.tar.gz+node-v8.1.2-linux-x64.ta
elasticsearch-analysis-ik-7.17.0
最新版linux elasticsearch-7.13.3-linux-x86_64.tar.gz最新版linux elasticsearch-7.13.3-linux-x86_64.tar.gz
最新版linux elasticsearch-7.13.4-linux-x86_64.tar.gz最新版linux elasticsearch-7.13.4-linux-x86_64.tar.gz
资源来自pypi官网。 资源全名:elasticsearch-7.14.2-py2.py3-none-any.whl
elasticsearch-7.17.4-x86_64.rpm文件 elasticsearch-7.17.4-x86_64.rpm文件 elasticsearch-7.17.4-x86_64.rpm文件 elasticsearch-7.17.4-x86_64.rpm文件 elasticsearch-7.17.4-x86_64.rpm文件 elasticsearch-7.17.4...
最新版 elasticsearch-analysis-ik-7.17.6.zip最新版 elasticsearch-analysis-ik-7.17.6.zip
elasticsearch-6.2.4.tar.gz与kibana-6.2.4-linux-x86_64.tar.gz 自己用的linux版安装包 安全 放心 方便易学习
最新版linux elasticsearch-7.12.0-linux-x86_64.tar.gz最新版linux elasticsearch-7.12.0-linux-x86_64.tar.gz
elasticsearch-6.5.4.tar.gz elasticsearch-analysis-ik-6.5.4 (1).zip es linux安装包及ik分词器插件 打包 elasticsearch-6.5.4.tar.gz elasticsearch-analysis-ik-6.5.4 (1).zip es linux安装包及ik分词器插件 ...
elasticsearch-ik-7.16.2 分词器
包含elasticsearch-6.2.4.tar.gz 和 kibana-6.2.4-linux-x86_64..tar.gz
最新版linux elasticsearch-7.13.2-linux-x86_64.tar.gz最新版linux elasticsearch-7.13.2-linux-x86_64.tar.gz
elastic-agent-7.17.4-x86_64.rpm文件 elastic-agent-7.17.4-x86_64.rpm文件 elastic-agent-7.17.4-x86_64.rpm文件 elastic-agent-7.17.4-x86_64.rpm文件 elastic-agent-7.17.4-x86_64.rpm文件 elastic-agent-7.17.4...
最新版 elasticsearch-analysis-ik-8.7.0.zip最新版 elasticsearch-analysis-ik-8.7.0.zip最新版 elasticsearch-analysis-ik-8.7.0.zip最新版 elasticsearch-analysis-ik-8.7.0.zip
elasticsearch-6.2.2.tar.gz elasticsearch-6.2.3.zip elasticsearch-6.6.2.tar.gz elasticsearch-6.8.4.zip elasticsearch-7.3.2-linux-x86_64.tar.gz elasticsearch-7.3.2-windows-x86_64.zip elasticsearch-...
最新版windows elasticsearch-7.17.6-windows-x86_64.zip最新版windows elasticsearch-7.17.6-windows-x86_64.zip
elasticsearch-analysis-ik-7.14.0-c.zip elasticsearch-analysis-ik-7.14.0-c.zip elasticsearch-analysis-ik-7.14.0-c.zip
最新版elasticsearch-7.17.0-windows-x86_64
资源分类:Python库 所属语言:Python 资源全名:elasticsearch-7.15.0-py2.py3-none-any.whl 资源来源:官方 安装方法:https://lanzao.blog.csdn.net/article/details/101784059