ES AlertBuddy

ElasticSearch Alerting Engine

Install

$ npm install -g @hashology/es-alertbuddy
$ es-alertbuddy -c <config file>

Configuration

Example Config File

---
  elasticsearch:
    endpoint: https://elasticsearch.local/_opendistro/_sql
  logging:
    level: info
    destination:
      type: file
      path: /tmp/alert-buddy.log
      format: pretty
  alerts:
    directory: ./watchers

Example Watcher

  name: Running Pods
  query: >-
    SELECT kubernetes.namespace
      ,kubernetes.deployment.name
      ,avg(kubernetes.deployment.replicas.desired) / avg(kubernetes.deployment.replicas.available) as running_value
    FROM metricbeat*
    WHERE kubernetes.deployment.name IN (
        'nginx-deployment'
        )
      AND @timestamp >= 'now-5m'
    GROUP BY kubernetes.namespace
      ,kubernetes.deployment.name
    LIMIT 1
  condition:
    all:
      - fact: result
        operator: notEqual
        value: 1
        path: $.running_value
  schedule: "*/5 * * * *"
  alert:
    type: webhook
    throttle: 15
    endpoint: https://events.pagerduty.com/v2/enqueue
    headers:
      X-Routing-Key: <X-Routing-Key>
      Content-Type: application/json
    body:
      event_action: trigger
      payload:
        summary: The deployment {{'kubernetes.deployment.name'}} in namespace {{'kubernetes.namespace'}} is not running the desired number of pods.
        source: es-alertbuddy
        severity: warning