update core constructs definition
Original commit: elastic/x-pack-elasticsearch@d550e0abd1
This commit is contained in:
parent
69bbea6985
commit
aa529f1c3b
|
@ -4,4 +4,28 @@ This plugins adds alerting features to elasticsearch
|
||||||
|
|
||||||
You can build the plugin with `mvn package`.
|
You can build the plugin with `mvn package`.
|
||||||
|
|
||||||
The documentation is put in the `docs/` directory.
|
The documentation is put in the `docs/` directory.
|
||||||
|
|
||||||
|
== Core Concepts
|
||||||
|
|
||||||
|
Alert :: a tuple of: *Schedule*, *Condition* and a list of *Action*s, where the schedule defines when the alert is checked
|
||||||
|
(see below), the condition checks whether the alert should be executed and the actions define what happens when the alert
|
||||||
|
is executed.
|
||||||
|
Schedule :: defines when and how often should the alert be checked (e.g. every 5 minutes, every
|
||||||
|
first wednesday of the month at noon, etc..)
|
||||||
|
Condition :: represents a condition based on which a decision is made to execute the alert or not
|
||||||
|
Action :: defines the actions that are taken when the alert executes
|
||||||
|
|
||||||
|
|
||||||
|
== Alert Events
|
||||||
|
|
||||||
|
`checked` :: the `Scheduler` fired an event that caused the condition of the alert to be evaluated
|
||||||
|
`throttled` :: the alert's condition was checked and met, but a decision was made **not** to **execute* the alert.
|
||||||
|
This can be based on the throttle period that is associated with the alert, or based on the fact that the
|
||||||
|
alert was `acked`
|
||||||
|
`executed` :: the alert's condition was checked and met and no throttling took place - the actions were executed.
|
||||||
|
`acked` :: the user acked the alert, causing it to stop executing its action until it's condition is not met anymore
|
||||||
|
|
||||||
|
== Alert Run Process
|
||||||
|
|
||||||
|
image:docs/alert-run.png[]
|
||||||
|
|
Loading…
Reference in New Issue