Elastalert 插件安装
参考：https://elastalert.readthedocs.io/en/latest/running_elastalert.html
安装 pip
$ wget https://bootstrap.pypa.io/get-pip.py
$ python get-pip.py
下载模块
$ pip install "setuptools>=11.3"
$ python setup.py install
通过 git 安装或者 pip 安装
$ cd /usr/local/
$ git clone https://github.com/Yelp/elastalert.git
Elasticsearch 6.3:
$ pip install "elasticsearch>=6.3.1"
创建索引：
$ /usr/local/elastalert master elastalert-create-index
Elastic Version:6
Mapping used for string:{'type': 'keyword'}
Index elastalert_status already exists. Skipping index creation.
在这可以发现索引已经有了，查看一下索引：
curl 'localhost:9200/_cat/indices?v'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open elastalert_status fR_R5bOGSqCFS6ezK2RMNA 5 1 0 0 1.2kb 1.2kb
出现了一个错误：
yaml.parser.ParserError: while parsing a block mapping
in "example_rules/example_frequency.yaml", line 20, column 1
did not find expected key
in "example_rules/example_frequency.yaml", line 46, column 2
是因为example_frequency.yaml 里添加的 SMTP 配置前面有空格，yaml 一定要注意空格的问题！
image
image
