CentOS7零基础部署ELK（7.2.0）集群步骤并监控日志告警

#! /usr/bin/python # -*- coding: utf-8 -*- """ # Description: Send alert using HuaWeiCloud/ALiYun/TencentCloud SMS service # Date: 2019-06-03 # License: MIT """ import requests from elastalert.alerts import Alerter, BasicMatchString from elastalert.util import elastalert_logger, EAException, lookup_es_key import datetime from requests.exceptions import RequestException # 发送飞鸽模板短信 class FeigeTemplateSmsAlerter(Alerter): required_options = frozenset(['feige_account', 'feige_pwd', 'sign_id', 'phone_number', 'template_id', 'template_variable_format', 'template_variable_args']) def __init__(self, *args): super(FeigeTemplateSmsAlerter, self).__init__(*args) # 从规则配置文件(xxx.yaml)中读取相应的配置 self.Account = self.rule.get('feige_account') # 飞鸽用户账号 self.Pwd = self.rule.get('feige_pwd') # 飞鸽应用集成中的短信请求秘钥，为25-28位加密字符串 self.SignId = self.rule.get('sign_id') # 短信签名，建议2-8字符，id可在管理后台获取、添加、编辑 self.Mobile = self.rule.get('phone_number') # 发送的短信号码，多个号码以逗号分隔 self.TemplateId = self.rule.get('template_id') # 短信免审模板ID，ID可在管理后台获取、添加、编辑 self.TemplateVariableFormat = self.rule.get('template_variable_format') # 模板变量格式，多个变量以||进行分隔，按顺序排列 self.TemplateVariableArgs = self.rule.get('template_variable_args') # 模板变量值，与template_variable_format对应，按顺序排列 # optional self.SendTime = self.rule.get('send_time', 0) # 定时发送时间的时间戳，需要把时间转为时间戳：1477366109(2016-10-25 11:28:29) self.TemplateVariableMaxLen = self.rule.get('template_variable_max_len', 70) # 模板变量的值最大长度设置，默认500 self.SmsStartTime = self.rule.get('sms_start_time', '00:00:00') # 短信开始发送时间 self.SmsEndTime = self.rule.get('sms_end_time', '23:59:59') # 短信停止发送时间，如果比开始发送时间小，天数将加一，默认为第二天的时间 self.SmsTimeout = self.rule.get('sms_timeout', 15) # 短信发送超时时间，单位为秒，默认15 def create_default_title(self, matches): subject = 'ElastAlert: %s' % (self.rule['name']) return subject def alert(self, matches): # body = self.create_alert_body(matches) # 短信服务暂不支持这样传递body ''' # 所以不能直接使用body，要间接使用 # 取单独的值，放入对应短信模板的变量值中。但我觉得没有钉钉这样好用了 # 如 sms_level = self.matches.get['level'] sms_log_message = self.matches.get['log_message'] # 然后将取的值传递到发送短信的程序中 ''' send_url = 'http://api.feige.ee/SmsService/Template' headers = {'content-type': 'application/x-www-form-urlencoded'} content = self.create_template_variable(matches) # elastalert_logger.info('content string ---------- %s' % content) payload = { 'Account': self.Account, 'pwd': self.Pwd, 'Content': content, 'Mobile': self.Mobile, 'TemplateId': self.TemplateId, 'SignId': self.SignId } # elastalert_logger.info('当前年月日时分秒：%s ---------- 年月日：%s ----------' % (time.strftime('%Y-%m-%d %H:%M:%S', time.localtime()), time.strftime('%Y-%m-%d', time.localtime()))) today = datetime.date.today().__str__() startdatetime = today + ' ' + self.SmsStartTime enddatetime = today + ' ' + self.SmsEndTime start_date_time = datetime.datetime.strptime(startdatetime, '%Y-%m-%d %H:%M:%S') end_date_time = datetime.datetime.strptime(enddatetime, '%Y-%m-%d %H:%M:%S') if end_date_time <= start_date_time: _days = datetime.timedelta(days=1) end_date_time += _days now_date_time = datetime.datetime.now() if start_date_time <= now_date_time and now_date_time <= end_date_time: response = '' try: elastalert_logger.info(u'开始调用短信接口') response = requests.post(send_url, data=payload, headers=headers, timeout=self.SmsTimeout) elastalert_logger.info(u'接口调用成功') response.raise_for_status() except RequestException as e: elastalert_logger.error(u'-----打印错误------------------------------') raise EAException(e) elastalert_logger.info(u'飞鸽平台发送短信返回结果: %s' % response.text) else: elastalert_logger.info(u'当前时间【%s】不在发送范围', now_date_time) def create_template_variable(self, matches): template_variable = unicode(self.rule['template_variable_format']) template_variable_max_len = int(self.rule.get('template_variable_max_len', 70)) if 'template_variable_args' in self.rule: template_variable_args = self.rule['template_variable_args'] template_variable_values = [lookup_es_key(matches[0], arg) for arg in template_variable_args] timestamp = lookup_es_key(matches[0], '@timestamp') rubyexception = lookup_es_key(matches[0], 'rubyexception.message') rubyexception2 = lookup_es_key(matches[0], 'rubyexception2') for i, subject_value in enumerate(template_variable_values): alert_value = '' if subject_value is None: alert_value = self.rule.get(template_variable_args[i]) if timestamp and '@timestamp' == template_variable_args[i]: _hours = datetime.timedelta(hours=8) timestamp = timestamp[0:19] timestamp = datetime.datetime.strptime(timestamp, '%Y-%m-%dT%H:%M:%S') alert_value = timestamp + _hours elif rubyexception and 'response_detail.message' == template_variable_args[i]: alert_value = rubyexception elif rubyexception2 and 'response_detail.message' == template_variable_args[i]: alert_value = rubyexception2 if alert_value: template_variable_values[i] = alert_value missing = self.rule.get('alert_missing_value', '<MISSING VALUE>') template_variable_values = [missing if val is None else val for val in template_variable_values] template_variable = template_variable.format(*template_variable_values) if len(template_variable) > template_variable_max_len: template_variable = template_variable[:template_variable_max_len] return template_variable def get_info(self): return { 'type': 'FeigeTemplateSmsAlerter' } # Send alert using HuwWeiCloud SMS service class HuaWeiCloudAlerter(Alerter): """ self.required_options: This is a set containing names of configuration options that must be present. ElastAlert will not instantiate the alert if any are missing. frozenset()不可变，而set()是可变的。 """ required_options = frozenset(['hw_url', 'hw_ak', 'hw_sk', 'hw_sender', 'hw_template_id', 'hw_signature', 're