我有一个弹性dsl查询，它返回了过去15分钟api的平均响应时间。
我的目标是在api平均响应时间>5秒时发送电子邮件。
在下面的查询响应中，我得到的平均值是5.32。但在elastalert规则中，不会为同一配置生成警报。
dsl查询

{
   "aggs":{
      "processFilter":{
         "filter":{
            "bool":{
               "should":[
                  {
                     "bool":{
                        "must":[
                           {
                              "match":{
                                 "doc.processName":"CreateCustomer"
                              }
                           },
                           {
                              "match":{
                                 "doc.messageType":"SourceResponse"
                              }
                           },
                           {
                              "range":{
                                 "@timestamp":{
                                    "gte":"now-30m/m",
                                    "lte":"now/m"
                                 }
                              }
                           }
                        ]
                     }
                  }
               ]
            }
         },
         "aggs":{
            "avg_et":{
               "avg":{
                  "field":"elapsed_time"
               }
            }
         }
      }
   }
}

答复：

"aggregations" : {
    "processFilter" : {
      "meta" : { },
      "doc_count" : 5,
      "**avg_et**" : {
        "value" : 5.3289999008178714
      }
    }
  }
}

规则.yaml

es_host: 100.10.10.100
es_port: 9200
es_username: elastic
es_password: elastic
name: Average ResponseTime
type: metric_aggregation
index: logstashlogs-*
bucket_interval:
  minutes: 15
metric_agg_key: elapsed_time
metric_agg_type: avg
doc_type: _doc
max_threshold: 5
filter:
  - term:
      doc.processName: CreateCustomer
  - term:
      doc.messageType: SourceResponse

alert:
  - email
email:
  - Test1234@gmail.com
alert_subject: Avg response lapsed
alert_text: |
  Testing for average response time.
alert_text_type: alert_text_only
smtp_host: 100.100.10.10
smtp_port: 25
smtp_ssl: false
from_addr: test@gmail.com
smtp_auth_file: smtp_auth_file.yaml

elastalert输出

1 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999888 seconds
INFO:elastalert:Ran Average ResponseTime from 2020-10-21 11:42 UTC to 2020-10-21 11:57 UTC: 0 query hits (0 already seen), 0 matches, 0 alerts sent
INFO:elastalert:Background configuration change check run at 2020-10-21 11:58 UTC
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2020-10-21 11:58 UTC