如果在过去 n 秒内没有输入，则实现 watcher 发送邮件

Question

我正在尝试为以下场景设置观察者

如果过去 n 小时内没有文档插入索引，则发出警报。这样我们就可以检查我们的节点和弹性搜索之间的连接故障是否存在任何问题。

为了实现这样的场景，我使用以下 json 进行复制。

curl -XPUT 'http://10.x.x.1:9200/_watcher/watch/log_error_watch' -d '{
  "trigger" : { "schedule" : { "interval" : "10s" } },
  "input" : {
    "search" : {
      "request" : {
        "indices" : [ "test" ],
        "body" : {
          "query" : {
            "match_all" : {}
          }
        }
      }
    }
  },
  "condition": {
    "array_compare": {
      "ctx.payload.aggregations.test.buckets" : { 
        "path": "doc_count" ,
        "lt": { 
          "value": 1, 
          "quantifier": "some" 
        }
      }
    }
  },
  "actions" : {
    "log_error" : {
      "logging" : {
        "text" : "No data for past 10 seconds"
      }
    }
  }
}'

但它没有将警报消息放入日志中。有人可以帮我解决条件部分的逻辑。

Answer 1

改用这个条件：

  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  }

Answer 2

{
    "trigger": {
      "schedule": {
        "interval": "5m"
      }
    },
    "input": {
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "filebeat-*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0, 
   "query": {
     "bool": {
       "filter": [
         {
           "terms": {
             "product": [
               "ABC",
               "XYZ"
             ]
           }
         },
         {
           "term": {
             "env": "PROD"
           }
         },
         { "range": {
        "@timestamp": {
        "gte": "now-1m",
        "lte": "now",
        "format": "strict_date_optional_time"
             }
         }}
       ]
     }
   },
   "aggs": {
        "NAME": {
          "terms": {
            "field": "hostname",
            "size": 100,
            "min_doc_count": 0,
            "include": ".*PROD.*"
      }
     }
   }
          }
        }
      }
    },
    "condition": {
      "array_compare": {
        "ctx.payload.aggregations.NAME.buckets": {
          "path": "doc_count",
          "eq": {
              "value": 0
          }
        }
      }
    },
    "actions": {
      "send_email": {
        "email": {
          "profile": "standard",
          "to": [
            "email@email.com"
          ],
          "subject": "No Logs in Kibana for 5 minutes",
          "body": {
            "html": """<h2><font color="red">Team, <br>Logs are not coming for below environment for 5 Minutes</br></font></h2>
  <table>
  <table border="1">
    <tr>
      <th>Environment</th>
      <th>Doc Count</th>
    </tr>
  {{#ctx.payload.aggregations.NAME.buckets}}
  <tr>
      <td>{{key}}</td>
      <td>{{doc_count}}</td>
  </tr>
  {{/ctx.payload.aggregations.NAME.buckets}}
  </table>"""
          }
        }
      }
    }
  }