ELK安装Sentinl插件以及钉钉机器人告警

Sentinl插件下载

注意sentinl版本要和elk 版本一致，否则像下面一样安装不了

[root@localhost share]# /usr/share/kibana/bin/kibana-plugin install file:///usr/share/sentinl-v7.6.1.zip 
Attempting to transfer from file:///usr/share/sentinl-v6.8.4.zip
Transferring 313168352 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Plugin installation was unsuccessful due to error "Plugin sentinl [7.6.1] is incompatible with Kibana [6.8.4]"

Sentinl插件安装

把file后面修改成你存放sentinl的路径就行

/usr/share/kibana/bin/kibana-plugin install file:///usr/share/sentinl-v6.8.4.zip

安装好重启一下再访问就发现菜单栏多了个Sentinl

Sentinl钉钉告警

创建高级watcher

配置如下

name：watcher 执行名称
title：watcher 标题
every 1 minutes：间隔一分钟执行一次
这三个配置可以再列表直接展示出来

index：索引名称
match：匹配字段的值
size：查到的数据保存多少条
payload.hits.total > 0：查询到的记录大于0条

{
  "actions": {
    "1dcf2d50-d58b-11ec-b3f1-59ea6727fbdc": {
      "name": "Webhook-demo",
      "throttle_period": "1s",
      "webhook": {
        "priority": "high",
        "stateless": false,
        "method": "POST",
        "host": "oapi.dingtalk.com",
        "port": "443",
        "path": "/robot/send?access_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "body": "{ \"msgtype\": \"text\", \"text\": { \"content\": \"_id：{{payload.hits.hits.0._id}}\nid: {{payload.hits.hits.0._source.host.id}} \" } }",
        "params": {
          "watcher": "{{watcher.title}}",
          "payload_count": "{{payload.hits.total}}"
        },
        "headers": {
          "Content-Type": "application/json"
        },
        "auth": "",
        "message": "",
        "use_https": true
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "index": [
          "file*"
        ],
        "body": {
          "size": 1,
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "_index": "filebeat"
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1m",
                      "lte": "now",
                      "format": "epoch_millis"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "script": "payload.hits.total > 0"
    }
  },
  "trigger": {
    "schedule": {
      "later": "every 1 minutes"
    }
  },
  "disable": false,
  "report": false,
  "title": "sentinl钉钉告警demo",
  "save_payload": true,
  "spy": false,
  "impersonate": false
}