mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
142 lines
No EOL
6 KiB
Text
142 lines
No EOL
6 KiB
Text
[[transform-alerts]]
|
|
= Generating alerts for {transforms}
|
|
:frontmatter-description: Create {transform} health rules.
|
|
:frontmatter-tags-products: [alerting]
|
|
:frontmatter-tags-content-type: [how-to]
|
|
:frontmatter-tags-user-goals: [configure]
|
|
|
|
{kib} {alert-features} include support for {transform} health rules, which
|
|
check the health of {ctransforms} with certain conditions. If the conditions of
|
|
the rule are met, an alert is created and the associated actions run. For
|
|
example, you can create a rule to check if a {ctransform} is started and to
|
|
notify you in an email if it is not. To learn more about {kib} {alert-features},
|
|
refer to
|
|
{kibana-ref}/alerting-getting-started.html#alerting-getting-started[Alerting].
|
|
|
|
[[creating-transform-rules]]
|
|
== Creating a rule
|
|
|
|
You can create {transform} rules under **{stack-manage-app} > {rules-ui}**.
|
|
|
|
On the *Create rule* window, give a name to the rule and optionally provide
|
|
tags. Select the {transform} health rule type:
|
|
|
|
[role="screenshot"]
|
|
image::images/transform-rule.png["Creating a transform health rule",500]
|
|
// NOTE: This is screenshot is automatically generated. Do not edit it directly.
|
|
|
|
Select the {transform} or {transforms} to include. You can also use a special
|
|
character (`*`) to apply the rule to all your {transforms}. {transforms-cap}
|
|
created after the rule are automatically included.
|
|
|
|
The following health checks are available and enabled by default:
|
|
|
|
_{transform-cap} is not started_::
|
|
Notifies if the corresponding {transforms} is not started or it does not index
|
|
any data. The notification message recommends the necessary actions to solve
|
|
the error.
|
|
|
|
_Errors in {transform} messages_::
|
|
Notifies if {transform} messages contain errors.
|
|
|
|
[role="screenshot"]
|
|
image::images/transform-check-config.png["Selecting health check",500]
|
|
// NOTE: This is screenshot is automatically generated. Do not edit it directly.
|
|
|
|
As the last step in the rule creation process, define its actions.
|
|
|
|
[[defining-actions]]
|
|
== Defining actions
|
|
|
|
You can add one or more actions to your rule to generate notifications when its
|
|
conditions are met and when they are no longer met. In particular, this rule
|
|
type supports:
|
|
|
|
* alert summaries
|
|
* actions that run when an issue is detected
|
|
* recovery actions that run when the rule conditions are no longer met
|
|
|
|
For each action, you must choose a connector, which provides connection
|
|
information for a {kib} service or third party integration. For more information
|
|
about all the supported connectors, go to
|
|
{kibana-ref}/action-types.html[Connectors].
|
|
|
|
After you select a connector, you must set the action frequency. You can choose
|
|
to create a summary of alerts on each check interval or on a custom interval.
|
|
For example, send notifications that summarize the new, ongoing, and recovered
|
|
alerts:
|
|
|
|
[role="screenshot"]
|
|
image::images/transform-alert-summary-actions.png["Setting action frequency to summary of alerts",500]
|
|
// NOTE: This is screenshot is automatically generated. Do not edit it directly.
|
|
|
|
TIP: If you choose a custom action interval, it cannot be shorter than the
|
|
rule's check interval.
|
|
|
|
Alternatively, you can set the action frequency such that actions run for each
|
|
alert. Choose how often the action runs (at each check interval, only when the
|
|
alert status changes, or at a custom action interval). You must also choose an
|
|
action group, which indicates whether the action runs when the issue is detected
|
|
or when it is recovered.
|
|
|
|
You can further refine the conditions under which actions run by specifying that
|
|
actions only run when they match a KQL query or when an alert occurs within a
|
|
specific time frame.
|
|
|
|
There is a set of variables that you can use to customize the notification
|
|
messages for each action. Click the icon above the message text box to get the
|
|
list of variables or refer to <<transform-action-variables>>.
|
|
|
|
[role="screenshot"]
|
|
image::images/transform-alert-actions.png["Selecting action variables",500]
|
|
// NOTE: This is screenshot is automatically generated. Do not edit it directly.
|
|
|
|
After you save the configurations, the rule appears in the *{rules-ui}* list
|
|
where you can check its status and see the overview of its configuration
|
|
information.
|
|
|
|
The name of an alert is always the same as the {transform} ID of the associated
|
|
{transform} that triggered it. You can mute the notifications for a particular
|
|
{transform} on the page of the rule that lists the individual alerts. You can
|
|
open it via *{rules-ui}* by selecting the rule name.
|
|
|
|
[[transform-action-variables]]
|
|
== Action variables
|
|
|
|
The following variables are specific to the {transform} health rule type.
|
|
You can also specify {kibana-ref}/rule-action-variables.html[variables common to all rules].
|
|
|
|
`context.message`::
|
|
A preconstructed message for the rule. For example: `Transform test-1 is not started.`
|
|
|
|
`context.results`::
|
|
The most recent results, which you can iterate over by using the
|
|
https://mustache.github.io/[Mustache] template array syntax. For example, the
|
|
message in an email connector action might contain:
|
|
+
|
|
--
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
[{{rule.name}}] Transform health check result:
|
|
{{context.message}}
|
|
{{#context.results}}
|
|
Transform ID: {{transform_id}}
|
|
{{#description}}Transform description: {{description}}
|
|
{{/description}}{{#transform_state}}Transform state: {{transform_state}}
|
|
{{/transform_state}}{{#health_status}}Transform health status: {{health_status}}
|
|
{{/health_status}}{{#issues}}Issue: {{issue}}
|
|
Issue count: {{count}}
|
|
{{#details}}Issue details: {{details}}
|
|
{{/details}}{{#first_occurrence}}First occurrence: {{first_occurrence}}
|
|
{{/first_occurrence}}
|
|
{{/issues}}{{#failure_reason}}Failure reason: {{failure_reason}}
|
|
{{/failure_reason}}{{#notification_message}}Notification message: {{notification_message}}
|
|
{{/notification_message}}{{#node_name}}Node name: {{node_name}}
|
|
{{/node_name}}{{#timestamp}}Timestamp: {{timestamp}}
|
|
{{/timestamp}}
|
|
{{/context.results}}
|
|
--------------------------------------------------
|
|
--
|
|
|
|
For more examples, refer to
|
|
{kibana-ref}/rule-action-variables.html[Rule action variables]. |