事件日志索引
编辑事件日志索引
编辑此功能处于技术预览阶段，可能会在未来的版本中更改或删除。Elastic 将努力修复任何问题，但技术预览版中的功能不受官方 GA 功能的支持 SLA 约束。
使用事件日志索引来确定
- 规则是否成功运行但其关联的操作未运行
- 规则是否曾经被激活
- 有关规则运行时错误的附加信息
- 规则和操作的运行持续时间
示例事件日志查询
编辑以下事件日志查询查看与特定规则 ID 相关的所有事件
GET /.kibana-event-log*/_search
{
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
],
"query": {
"bool": {
"filter": [
{
"term": {
"event.provider": {
"value": "alerting"
}
}
},
// optionally filter by specific action event
{
"term": {
"event.action": "active-instance"
| "execute-action"
| "new-instance"
| "recovered-instance"
| "execute"
}
},
// filter by specific rule id
{
"nested": {
"path": "kibana.saved_objects",
"query": {
"bool": {
"filter": [
{
"term": {
"kibana.saved_objects.id": {
"value": "b541b690-bfc4-11eb-bf08-05a30cefd1fc"
}
}
},
{
"term": {
"kibana.saved_objects.type": "alert"
}
}
]
}
}
}
}
]
}
}
}
以下事件日志查询查看与运行规则或操作相关的所有事件。这些事件包括持续时间
GET /.kibana-event-log*/_search
{
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
],
"query": {
"bool": {
"filter": [
{
"term": {
"event.action": {
"value": "execute"
}
}
},
// optionally filter by specific rule or action id
{
"nested": {
"path": "kibana.saved_objects",
"query": {
"bool": {
"filter": [
{
"term": {
"kibana.saved_objects.id": {
"value": "b541b690-bfc4-11eb-bf08-05a30cefd1fc"
}
}
}
]
}
}
}
}
]
}
}
}
以下事件日志查询查看错误。您应该在该事件中看到一个 error.message 属性，其中包含一条消息，该消息可能会提供有关该操作为何遇到错误的更多详细信息
{
"event": {
"provider": "actions",
"action": "execute",
"start": "2020-03-31T04:27:30.392Z",
"end": "2020-03-31T04:27:30.393Z",
"duration": 1000000
},
"kibana": {
"namespace": "default",
"saved_objects": [
{
"type": "action",
"id": "7a6fd3c6-72b9-44a0-8767-0432b3c70910"
}
],
},
"message": "action executed: .server-log:7a6fd3c6-72b9-44a0-8767-0432b3c70910: server-log",
"@timestamp": "2020-03-31T04:27:30.393Z",
}
您可能还会看到规则的错误，可以在下一个搜索查询中使用。例如
{
"event": {
"provider": "alerting",
"start": "2020-03-31T04:27:30.392Z",
"end": "2020-03-31T04:27:30.393Z",
"duration": 1000000
},
"kibana": {
"namespace": "default",
"saved_objects": [
{
"rel" : "primary",
"type" : "alert",
"id" : "30d856c0-b14b-11eb-9a7c-9df284da9f99"
}
],
},
"message": "rule executed: .index-threshold:30d856c0-b14b-11eb-9a7c-9df284da9f99: 'test'",
"error" : {
"message" : "Saved object [action/ef0e2530-b14a-11eb-9a7c-9df284da9f99] not found"
},
}
您还可以查询事件日志中的失败，这将通过定位 event.outcome 返回有关失败规则的更具体详细信息
GET .kibana-event-log-*/_search
{
"query": {
"bool": {
"must": [
{ "match": { "event.outcome": "failure" }}
]
}
}
}
以下是一个示例，说明来自 Google SMTP 的失败凭据在响应中的样子
"error" : {
"message" : """error sending email: Invalid login: 535-5.7.8 Username and Password not accepted. Learn more at
535 5.7.8 https://support.google.com/mail/?p=BadCredentials e207sm3359731pfh.171 - gsmtp"""
},