即使满足警报条件，ElastAlert 范围查询也不会发送警报电子邮件

Question

我按照以下设置我的 ElastAlert 规则。

MyRangeAlert.yaml: |-
---
name: MyRangeAlert
type: frequency
limit_execution: "0/8 * * * *"
index: myindex-*
num_events: 1
timeframe:
  minutes: 15
filter:
- query:
    query_string:
      query: "request.keyword: \"\/api\/rest\/cms\/content\/cited-by\/\" AND response:503"
- range:
  field3:
    from: 150
    to: 200
alert:
- "email"
email:
- "johndoe@gmail.com"
from_addr: "margert@gmail.com"
alert_subject: " High Response Time at {0}."
alert_subject_args:
- "@timestamp"
alert_text: "Average response {0} seconds observed in last 20 minutes."
alert_text_args:
- field3
alert_text_type: alert_text_only

然后我插入数据来满足条件

 PUT MyRangeAlert/_doc/501
{
    "request.keyword": "/api/rest/cms/content/cited-by/",
    "response": 503,
    "tags": "account_compromised",
    "alert-triggered": true,
    "field3": 156,
    "city": "Kansas",
    "name": "sameera",
    "description": "desccrption 1032",
    "@timestamp": "2021-01-06T11:31:23+0000"
}

不过。警报未发送电子邮件。我删除了范围，然后它开始发送警报。任何建议或半答案也非常感谢。

Answer 1

在字段 3.11= 前面添加 space 后出现缩进错误

filter:
    - query:
        query_string:
          query: "request.keyword: \"\/api\/rest\/cms\/content\/cited-by\/\" AND response:503"
    - range:
        field3:
          from: 150
          to: 200

即使满足警报条件，ElastAlert 范围查询也不会发送警报电子邮件

ElastAlert range query is not sending alert emails even though the alert condition is met

kibana

elastalert