elastaltert 配置企业邮箱告警

 配置企业邮箱告警
wget https://github.com/Hello-Linux/elastalert_wechat_plugin/archive/v1.0.1.zip
unzip v1.0.1.zip
mv elastalert_wechat_plugin-1.0.1/ elastalert_wechat_plugin
cp  -r elastalert_wechat_plugin/* /data/elastalert

root@elk /data/elastalert# cat config/config.yaml|grep -v "#"
rules_folder: /data/elastalert/es_rules 
run_every:
  minutes: 2
buffer_time:
  minutes: 2 
es_host: 10.32.1.21
es_port: 9200
writeback_index: elastalert_status
writeback_alias: elastalert_alerts

alert_time_limit:
  days: 1
cat es_rules/wechart.yaml|grep -v "#"
es_host: 10.32.1.21 
es_port: 9200
name: es_rule

type: frequency
index:  log-*
num_events: 1 
timeframe:
    minutes: 1
filter:
- query:
    query_string:
        query: "level: ERROR"
alert:
- "elastalert_modules.wechat_qiye_alert.WeChatAlerter"

alert_text_type: alert_text_only
alert_text: |
  ========start===========
  告警程序: ElasticSearch_Alert
  触发时间: {}
  告警主题: 线上后端 {} 服务异常
  触发条件: 一分钟内 >= {} 次
  异常内容: {}
  索引名称: {}
  主机名称: {}
  主机IP: {}
  traceId: {}
  stack_trace: {}
  ========end============
alert_text_args:
  - "@timestamp"
  - app_name
  - num_hits
  - message
  - _index
  - host
  - ip
  - traceId
  - stack_trace

corp_id: xxxx 
secret: xxxx
agent_id: 1000020xxx
party_id: ''
user_id: '@all'
tag_id: ''
root@elk /data/elastalert#  python -m elastalert.elastalert --verbose --config config/config.yaml --rule es_rules/wechart.yaml