参考：http://blog.csdn.net/ptmozhu/article/details/52296958
http://corejava2008.iteye.com/blog/2214279
一.watcher 插件安装
1.在ES_HOME目录下安装License插件:
bin/plugin install license
2.安装watcher插件
bin/plugin install watcher
3.重新启动Elasticsearch
bin/elasticsearch
4.验证是否安装成功
curl -XGET ‘http://localhost:9200/_watcher/stats?pretty‘
返回结果如下则表示安装成功
{
"watcher_state": "started",
"watch_count": 0,
"execution_thread_pool": {
"queue_size": 0,
"max_size": 0
}
}
二.watcher插件配置使用（报警错误日志）
Watcher支持的Action类型有四种：EMail(邮件),Webhook(第三方对接),Index(索引),Logging(日志记录)
配置流程：
1.Schedule the watch and define an input：设置定时器和输入源(错误数据的查询条件)
2.Add a condition：设置触发条件（condition是否查询到了错误数据）
3.Take action：设置触发动作(action发现错误后执行)
1.周期搜索日志文件并把结果装载到watcher，使用schedule和input配置。（如下为每隔10秒钟搜索错误日志）
curl -XPUT ‘http://localhost:9200/_watcher/watch/log_error_watch‘ -d ‘{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "logs" ],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
}
}‘
2.add a condition 设置触发条件（条件为日志错误条数大于0）
curl -XPUT ‘http://localhost:9200/_watcher/watch/log_error_watch‘ -d ‘{
"trigger" : { "schedule" : { "interval" : "10s" } },
"input" : {
"search" : {
"request" : {
"indices" : [ "logs" ],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
}
}‘
3.take action 设置触发动作（以下动作为当错误监测到时把信息写入到Elasticsearch日志中）
curl -XPUT ‘http://localhost:9200/_watcher/watch/log_error_watch‘ -d ‘{
"trigger" : { "schedule" : { "interval" : "10s" } },
"input" : {
"search" : {
"request" : {
"indices" : [ "logs" ],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"log_error" : {
"logging" : {
"text" : "Found {{ctx.payload.hits.total}} errors in the logs"
}
}
}
}‘
4.当该报警条件不用时，应当及时删除wacher api（节约计算资源）
curl -XDELETE ‘http://localhost:9200/_watcher/watch/log_error_watch‘
三.监控ElasticSearch集群状态：每10秒检测一次集群状态，如果集群状态错误(red)，则发送邮件给运维
curl -XPUT ‘http://localhost:9200/_watcher/watch/cluster_health_watch‘ -d ‘{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"http" : {
"request" : {
"host" : "localhost",
"port" : 9200,
"path" : "/_cluster/health"
}
}
},
"condition" : {
"compare" : {
"ctx.payload.status" : { "eq" : "red" }
}
},
"actions" : {
"send_email" : {
"email" : {
"to" : "<username>@<domainname>",
"subject" : "Cluster Status Warning",
"body" : "Cluster status is RED"
}
}
}
}‘
如果配置邮件发送，需要在ElasticSearch配置文件elasticsearch.yaml中配置以下信息
watcher.actions.email.service.account:
work:
profile: gmail
email_defaults:
from: <email>
smtp:
auth: true
starttls.enable: true
host: smtp.gmail.com
port: 587
user: <username>
password: <password>
邮件报警（profile）默认支持standard (default), gmail, and outlook。下面我使用163邮箱profile改为standard.
端口号使用25，同时必须在163邮箱中配置允许第三方邮箱客户端登陆，使用授权码登陆，而不是邮箱密码
watcher.actions.email.service.account:
work:
profile: standard
email_defaults:
from: ‘<yourname>@163.com‘
smtp:
auth: true
starttls.enable: true
host: smtp.163.com
port: 25
user: [email protected]
password: password