elastalert docker安装

小程序：扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序

基于对elasticsearch中数据监控需要，我尝试了sentinl和elastalert两款工具。虽然elastalert是纯文本，但易配置管理。elk自带的watch需要付费才可使用。

6.2x版本以上，需要先运行elastalert server服务(docker),然后在能使用kibana plugin elastalert插件

docker 安装 elastalert

注：docker安装时需要注意，需要安装最新的docker 17.x版本，否则无法make镜像

issues

elastalert server

$ cd /usr/local/python3 $ git clone https://github.com/bitsensor/elastalert.git && cd elastalert $ make build Sending build context to Docker daemon 150.5 kB Step 1/29 : FROM alpine:latest as py-ea Error parsing reference: "alpine:latest as py-ea" is not a valid repository/tag: invalid reference format###Dockerfile文件中给镜像取别名，将别名删除，在build$ docker build -t elastalert

镜像打完后：

$ docker images REPOSITORY TAG IMAGE ID CREATED SIZE elastalert latest 36984000449d 7 days ago 281MB###修改全局配置文件 $ vim config/config.json { "appName": "elastalert-server", "port": 3030, "wsport": 3333, "elastalertPath": "/opt/elastalert", "verbose": false, "es_debug": false, "debug": false, "rulesPath": { #规则配置文件存放目录 "relative": true, "path": "/rules" }, "templatesPath": { "relative": true, "path": "/rule_templates" }, "es_host": "192.168.20.5", #es host "es_port": 9200, "writeback_index": "elastalert_status" }$ grep "^[^#]" config/elastalert.yaml es_host: 192.168.20.5 es_port: 9200 rules_folder: rules #配置文件目录 run_every: #全局配置，多久执行一次配置文件 seconds: 30 buffer_time: #全局配置 minutes: 1 writeback_index: elastalert_status #查询匹配到的信息存放的索引名称 alert_time_limit: days: 2

启动服务：

$ docker run -d -p 3030:3030 \ -v /usr/local/python3/elastalert/config/elastalert.yaml:/opt/elastalert/config.yaml \ -v /usr/local/python3/elastalert/config/config.json:/opt/elastalert-server/config/config.json \ -v /usr/local/python3/elastalert/rules:/opt/elastalert/rules \ -v /usr/local/python3/elastalert/rule_templates:/opt/elastalert/rule_templates \ -v /usr/local/python3/elastalert/server_data:/opt/elastalert/server_data \ -v /usr/local/python3/elastalert/logs:/opt/logs \ --net=host --name elastalert elastalert:latest