Elasticsearch JIRA Alert and Email Notification using ElastAlert Library

In this post, I will be giving you sample example of how to create alerts and notifications on top of Elasticsearch using ElastAlert Library(opensource library from Yelp, https://github.com/Yelp/elastalert).

Requirements:

  Python 2.6/2.7

  pip

Step 1: clone the ElastAlert library

            git clone https://github.com/Yelp/elastalert.git

Step 2 : python setup.py install

Step 3: pip install -r requirements.txt

Step 4: Now start the elasticsearch and run below command from ElastAlert Library folder 

            elastalert-create-index 

 This will create index called "elastalert_status"  in elasticsearch, where all the alerts send and debugging information is stored.

Step 5: make sure you have config.yaml file properly configured with your elasticsearch host-port and rules folder where all alert rules file are located

Step 6: Now you can write your own rule file in your rules folder

            Sample Email Alert rule file content is as below, which send email notification whenever mentioned event(value of    y=50) occurs minimum 3 times within an hour

# Alert when the rate of events exceeds a threshold

# (Optional)

# Elasticsearch host

es_host: localhost

 -

# (Optional)

# Elasticsearch port

es_port: 9200

# (OptionaL) Connect with SSL to elasticsearch

#use_ssl: True

# (Optional) basic-auth username and password for elasticsearch

#es_username: someusername

#es_password: somepassword

# (Required)

# Rule name, must be unique

name: Example rule

# (Required)

# Type of alert.

# the frequency rule type alerts when num_events events occur with timeframe time

type: frequency

# (Required)

# Index to search, wildcard supported

index: logstash-*

# (Required, frequency specific)

# Alert when this many documents matching the query occur within a timeframe

num_events: 3

# (Required, frequency specific)

# num_events must occur within this amount of time to trigger an alert

timeframe:

  hours: 1

# (Required)

# A list of elasticsearch filters used for find events

# These filters are joined with AND and nested in a filtered query

# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html

filter:

- term:

    y: 50

# (Required)

# The alert is use when a match is found

alert:

- "email"

# (required, email specific)

"my_rules/example_frequency.yaml" 68L, 1675C

# The alert is use when a match is found

alert:

- "email"

# (required, email specific)

# a list of email addresses to send alerts to

email:

- "sendto@abc.com"

smtp_host: HOST URL

smtp_port: PORT NO.

from_addr: "xyz@abc.com"

Step 7: we can test whether our written rule is perfect or not as per syntax using below command

        elastalert-test-rule my_rules/email_rule.yaml

Step 8: Finally running our alert using below command
            python -m elastalert.elastalert --verbose --rule my_rules/email_rule.yaml

For more detailed information refer source : http://elastalert.readthedocs.io/en/latest/

(Note: While creating JIRA alert, set the jira_project property to the short name of the project, refer : http://stackoverflow.com/questions/38447519/http400-project-is-required-error-while-creating-jira-alert-using-yelp-elasta/38516278#38516278

https://github.com/Yelp/elastalert/issues/641

)