如何根据Kibana Watcher Action的条件成功将电子邮件警报发送给组

Question

我能够将各种错误分类---

​

类似----

错误时，即“键” =“响应状态代码不显示成功服务” ----将电子邮件发送到第1组[ [email＆nbsp; proceeded] ， 保护] ， email＆nbsp;

[电子邮件＆nbsp;受 错误，即“键” =“响应状态代码不表示成功网关” ----将电子邮件发送到第2组[ [email＆nbsp; preected] ，]

a>， [email＆nbsp; procation -

  "actions": {
"send_email": {
  "throttle_period_in_millis": 300000,
  "condition": {
    "script": {
      "source": " def status = false; for(int i=0; i<ctx.payload.failure_request.aggregations.categories.buckets.length;i++) {if(ctx.payload.failure_request.aggregations.categories.buckets[i].key.contains('Response status code does not indicate success')) {status = true}} return status ",
      "lang": "painless"
    }
  },
  "email": {
    "profile": "standard",
    "to": [
      "[email protected]"
    ],
    "subject": "{{ctx.metadata.email_subject}}",
    "body": {
      "html": "Error Found: <ul> {{ctx.payload.aggregations.categories.buckets.length}}"
                   }
                 }
              }
            }

当通过条件通过时，即使键包含该消息时，也将发送给给定的电子邮件。 但是我想一次，根据特定组的消息匹配发送电子邮件。

如果我们有一些无痛的语言来编写逻辑（例如案例语句），那么任何人都可以帮助我。

感谢您的帮助。

Answer 1

这些是我的建议，希望能为您提供帮助。

解决方案一： 与字符串

"actions": {
    "email_group_one" : {
        "condition": {
            "script": {
                "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Service Unavailable');"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJEC",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    },
    "email_group_two" : {
        "condition": {
            "script": {
                "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Gateway');"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJECT",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    }

}

解决方案两个： 与a，b，c和d（例如

"actions": {
    "email_group_one" : {
        "condition": {
            "script": {
                "source": "def myArray= ['a', 'b', 'c', 'd'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJEC",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    },
    "email_group_two" : {
        "condition": {
            "script": {
                "source": "def myArray= ['e', 'f', 'g', 'h'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJECT",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    }

}

该代码尚未测试，您可能有语法错误。