基礎架構之日誌管理平臺及釘釘&郵件告警通知

時間 2019-11-17

原文原文鏈接

接上一篇，咱們繼續解釋如何把ELK跟釘釘及發送郵件功能結合起來，讓咱們及時的瞭解重要日誌並快速反饋。html

Sentinel 安裝，項目介紹在https://github.com/sirensolutions/sentinl，點擊能夠詳細介紹。

運行命令轉到kibana的bin目錄git

cd /usr/share/kibana/bin

，這裏是默認安裝路徑，而後執行以下命令github

 ./kibana-plugin install https://github.com/sirensolutions/sentinl/releases/download/tag-6.3.2-beta-1/sentinl-v6.3.1.zip

，這裏根據服務器性能及網絡環境，可能要等一會才能看到成功的信息，成功後會自動刷新kibana服務，再次打開kibana，如圖所示說明安裝成功web

郵件通知

a) 要發送郵件，得先有一臺SMTP發送服務，我這裏用的是163，如今幾乎提供郵件功能的服務商均可以啓動SMTP功能，開通便可。json

b) 郵件配置，打開/etc/kibana/kibana.yml 文件，添加以下設置api

sentinl:

  settings:

    email:

      active: true

      user: lznboy-123@163.com

      password: 123456

      host: smtp.163.com

      ssl: false   #根據實際狀況添加

    report:

            active: true

千萬注意設置級別，否則會出現莫名的錯誤。服務器

c) 點擊sentinl，添加一個Watcher，我這裏配置信息以下。網絡

{

  "actions": {

    "Alerm": {

      "throttle_period": "1h0m0s",

      "email": {

        "to": "lznboy-123@163.com",

        "from": "lznboy-123@163.com",

        "subject": "業務系統告警",

        "priority": "high",

        "html": "系統程序錯誤告警: 一共發生{{payload.hits.total}} 次，請登陸覈查<a herf=\"http://192.168.1.215:5601\" target=\"_blank\">點擊登陸</a>"

      }

    }

  },

  "input": {

    "search": {

      "request": {

        "index": [

          "nlog*"

        ],

        "body": {

          "query": {

            "bool": {

              "must": [

                {

                  "query_string": {

                    "analyze_wildcard": true,

                    "query": "\"error\""

                  }

                },

                {

                  "range": {

                    "@timestamp": {

                      "gte": "now-1h",

                      "lte": "now",

                      "format": "epoch_millis"

                    }

                  }

                }

              ],

              "must_not": []

            }

          }

        }

      }

    }

  },

  "condition": {

    "script": {

      "script": "payload.hits.total >= 5"

    }

  },

  "trigger": {

    "schedule": {

      "later": "every 2 minutes"

    }

  },

  "disable": true,

  "report": false,

  "title": "nlog",

  "wizard": {},

  "save_payload": false,

  "spy": false,

  "impersonate": false

}

主要是配置接收者郵箱，判斷依據，判斷條件，觸發間隔app

d) 開啓Watcher並執行，以下圖所示。less

等一會，就會在alarms下看到告警信息。

打開配置文件中接收者的郵件，能夠看到收到的信息，個人信息以下

，說明郵件告警功能運行正常。

　　2. 釘釘消息

　　　　a) 釘釘接收消息，主要是利用釘釘的機器人功能，首先開通機器人，個人機器人設置以下

　　主要是利用webhook，接下來在設置發送消息中用到。

b) 釘釘Watcher設置，設置以下

{
  "actions": {
    "Webhook_683bd385-86b3-46ba-8e1b-f89cccccbbec": {
      "name": "WatcherName",
      "throttle_period": "1m",
      "webhook": {
        "priority": "high",
        "stateless": false,
        "method": "POST",
        "host": "oapi.dingtalk.com",
        "port": "443",
        "path": "/robot/send?access_token=ec5fe24b4a218f71bca667975850cbf3f2830b9bd2bd91f60ca07fab28a3d439",
        "body": " {\"msgtype\": \"text\",\r\n    \"text\": {\r\n        \"content\":\"業務系統告警\"\r\n          }\r\n}",
        "params": {
          "watcher": "{{watcher.title}}",
          "payload_count": "{{payload.hits.total}}"
        },
        "headers": {
          "Content-Type": "application/json"
        },
        "auth": "釘釘帳號名:密碼",
        "message": "業務功能告警",
        "use_https": true
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "index": [
          "nlog*"
        ],
        "body": {
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-15m/m",
                    "lte": "now/m",
                    "format": "epoch_millis"
                  }
                }
              }
            }
          },
          "size": 0,
          "aggs": {
            "dateAgg": {
              "date_histogram": {
                "field": "@timestamp",
                "time_zone": "Europe/Amsterdam",
                "interval": "1m",
                "min_doc_count": 1
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "script": "payload.aggregations.dateAgg.buckets.some(b => b.doc_count>=5)"
    }
  },
  "trigger": {
    "schedule": {
      "later": "every 1 minutes"
    }
  },
  "disable": true,
  "report": false,
  "title": "nlog_dingding",
  "wizard": {},
  "save_payload": false,
  "spy": false,
  "impersonate": false
}