elk或efk日志报警elastalert-docker安装-仅邮件

elk 或 efk 日志报警-elastalert-docker 安装

1.搭建 es 和 kibana（docker 安装-略）

[root@nacos-nfs es7.13_and_kibana7.13]# pwd

/data/es7.13_and_kibana7.13

[root@nacos-nfs es7.13_and_kibana7.13]# ls

data docker-compose.yml elasticsearch_7.13.2.tar kibana_7.13.2.tar

[root@nacos-nfs es7.13_and_kibana7.13]# docker-compose ps

Name Command State Ports

-----------------------------------------------------------------------------------------------------------

[root@nacos-nfs data]# tar -zxf elastalert-3.0.0-beta.1-image.tar.gz

[root@nacos-nfs data]# cd elastalert

[root@nacos-nfs elastalert]# ls

config images rules rule_templates

[root@nacos-nfs elastalert]# ls config/ #提前从容器里复制过来的目录,以映射到宿主机

config.json config.yaml

[root@nacos-nfs elastalert]# ls rule_templates/ #提前从容器里复制过来的目录,以映射到宿主机

detection_template.yaml error_jira_template.yaml no_data_template.yaml spike_template.yml threshold_template.yml

email_auth.yaml integration_started_template.yaml relevant_attack_template.yaml successful_attack_template.yaml volumetric_alert_template.yaml

[root@nacos-nfs elastalert]# ls images/

rules_folder: rules

run_every:

seconds: 5

buffer_time:

minutes: 1

writeback_index: elastalert_status

alert_time_limit:

days: 2

[root@nacos-nfs elastalert]# docker load -i images/elastalert_3.0.0_beta.1.tar #导入镜像

[root@nacos-nfs elastalert]# docker images |grep elastalert

-v /data/elastalert/rules:/opt/elastalert/rules \

-v /data/elastalert/rule_templates:/opt/elastalert/rule_templates \

--net=host bitsensor/elastalert:3.0.0-beta.1 #回车