Commit Graph

252 Commits

Author SHA1 Message Date
Brian Murphy 85655ac16d Alerts : Alert Transport Layer
This commit fixes the test and tests to make sure the alert we get back from
the alertsstore isn't null in execute alert since it may have been deleted.

Original commit: elastic/x-pack-elasticsearch@7a57dd090a
2014-11-04 17:03:03 +00:00
Brian Murphy a05fc88f0d Alerts: Transport actions
Add the UpdateAction (oops) and fix the test.

Original commit: elastic/x-pack-elasticsearch@ead7d446d7
2014-11-04 16:49:56 +00:00
Brian Murphy 75ce20ecff Alerting transport layer.
This commit adds the transport layer to the alerting plugin.

Original commit: elastic/x-pack-elasticsearch@a99dce9411
2014-11-04 16:49:56 +00:00
Martijn van Groningen 669203b2a1 Removed checks for creating alert & history index from code and use index templates instead
Original commit: elastic/x-pack-elasticsearch@c81134701f
2014-11-04 17:23:05 +01:00
Brian Murphy 69942c6c79 Alerting transport layer.
This commit adds the transport layer to the alerting plugin.

Original commit: elastic/x-pack-elasticsearch@0b6cb4760f
2014-11-04 16:21:57 +00:00
Martijn van Groningen c8c30f9b28 Properly resolve the place holders in the request source
Original commit: elastic/x-pack-elasticsearch@0d19c920d1
2014-11-04 16:01:20 +01:00
Martijn van Groningen 8ba9c1c609 Cleared up the alert / alert action entry classes and how the search request in the trigger manager gets prepared.
Original commit: elastic/x-pack-elasticsearch@52b16abb53
2014-11-04 11:27:58 +01:00
Martijn van Groningen 4373330a28 Changed the alert manager starting logic to move the loading logic down to alert store and alert action manager
Moved logic around from alert scheduler to action manager and trigger manager.

Original commit: elastic/x-pack-elasticsearch@8cba72b005
2014-10-31 10:28:42 +01:00
Martijn van Groningen 3e45310877 make more readable
Original commit: elastic/x-pack-elasticsearch@c7727618ac
2014-10-29 14:08:06 +01:00
Martijn van Groningen 12a6de0a57 Moved alert loading to use scan scroll instead of a single normal search
Original commit: elastic/x-pack-elasticsearch@06e70836ec
2014-10-29 10:20:36 +01:00
Martijn van Groningen 1e7fc84f06 Forgot to parse field
Original commit: elastic/x-pack-elasticsearch@23512bce74
2014-10-29 09:46:39 +01:00
Martijn van Groningen 3625b5bc91 Moved over the streaming parsing.
Original commit: elastic/x-pack-elasticsearch@10bd127df5
2014-10-29 00:54:18 +01:00
Martijn van Groningen 6b2fbe400e Introduced AlertsStore that is responsible for maintaining / storing / parsing etc of alerts
Original commit: elastic/x-pack-elasticsearch@40aae7dc30
2014-10-28 18:49:23 +01:00
Martijn van Groningen 34c359281a Added a todo
Original commit: elastic/x-pack-elasticsearch@56f5b1326b
2014-10-28 16:35:41 +01:00
Brian Murphy 879d88edac Merge pull request elastic/elasticsearch#21 from elasticsearch/alerthistory/jobqueue
Alerthistory/jobqueue

Original commit: elastic/x-pack-elasticsearch@87154dca40
2014-10-28 13:55:14 +00:00
Brian Murphy 4da8f9fec7 AlertActionManager: Add alert action job queue
This change adds the AlertActionManager and AlertActionEntry. The old AlertActionManager has become the AlertActionRegistry.
This means that now the results of Alerts are queued up in a job queue and executed in separate threads.
The AlertActionManager is a composite member of the AlertManager.
Change the BasicTest to just run on a single node to fix the action registration if the action happens on a different node.
Threads are not directly constructed but now the threadpool is used.
The ClusterStateListener in AlertManager is responsible now for starting the job queue.

Original commit: elastic/x-pack-elasticsearch@a73c6b60f8
2014-10-28 13:49:04 +00:00
Martijn van Groningen a23487cd38 Fixed build by:
* Using cluster state listener to clear alerts when .alerts index is removed. (when running on multiple nodes the .alerts index is scattered so indices listener doesn't work).
* Remove the starting / loading thread and move the initial loading to cluster state listener.

Original commit: elastic/x-pack-elasticsearch@b8f41db2ea
2014-10-25 23:37:05 +02:00
Bill Hwang 266a53d913 [CI] Add jacoco coverage profile
Original commit: elastic/x-pack-elasticsearch@1f9a665e8f
2014-10-24 10:16:03 -07:00
Martijn van Groningen 449edcda1d * Throw a understandle error if an alert action doesn't exist
* Moved over to a copy on write map instead of a hash map that is protected by synchronized blocks

Original commit: elastic/x-pack-elasticsearch@285515d585
2014-10-24 18:50:47 +02:00
Martijn van Groningen 39182616c7 Added slf4j log4j bindings for quartz :(
Original commit: elastic/x-pack-elasticsearch@2bc5bda9ed
2014-10-24 18:18:42 +02:00
Martijn van Groningen 1a32243781 Changes to AlertManager:
* Made use of IndicesLifecycle, to catch when the .alerts index gets deleted, so we can clear the alerts
* Moved to concurrent hashmap in favour over normal hashmap with synchronized blocks

Original commit: elastic/x-pack-elasticsearch@5599d01c78
2014-10-24 16:51:12 +02:00
Martijn van Groningen 16a7991d6d Rename and move the plugin class.
Original commit: elastic/x-pack-elasticsearch@b6f7a0490e
2014-10-24 14:31:20 +02:00
Brian Murphy 686f83ebb8 Merge pull request elastic/elasticsearch#14 from GaelTadh/change-packages
Alerting: Split alerting into packages

Original commit: elastic/x-pack-elasticsearch@68f2b86cb0
2014-10-24 13:22:15 +01:00
Brian Murphy ac979c880d Alerting : rename alerting package to alerts and fix test.
This commit renames the alerting package to alerts and will create the
alerts index on addAlert if needed.

Original commit: elastic/x-pack-elasticsearch@7cd691bd9b
2014-10-24 13:01:45 +01:00
Brian Murphy db9fae8021 Alerting: Split alerting into packages
This commit adds separate packages for actions,triggers,rest, and the scheduler.

Original commit: elastic/x-pack-elasticsearch@e104bbc521
2014-10-24 12:32:18 +01:00
Martijn van Groningen 9b7b2214c0 Removed duplicate dependency
Original commit: elastic/x-pack-elasticsearch@58a9068b61
2014-10-24 13:13:59 +02:00
Martijn van Groningen 96fe2d9ddf silly me
Original commit: elastic/x-pack-elasticsearch@b24829745d
2014-10-24 13:09:28 +02:00
Martijn van Groningen 6c66ca5fdc Build: Updated the groupId and artifactId
Original commit: elastic/x-pack-elasticsearch@326d53f3ec
2014-10-24 13:07:36 +02:00
Martijn van Groningen 75ef2dc3b3 Initial step to running alerts on master and added a very simple test.
Original commit: elastic/x-pack-elasticsearch@480f6bd44b
2014-10-24 12:49:33 +02:00
Brian Murphy f57ca58605 Alerting : Update the readme with right syntax for the commands
Original commit: elastic/x-pack-elasticsearch@bd78e7a2e9
2014-08-21 17:47:45 +01:00
Brian Murphy 8c623534c2 Alerting : Cleanup and fixes.
These changes fix the alert throttling during the time period, move alert history it's own
index.

Original commit: elastic/x-pack-elasticsearch@5130637824
2014-08-21 16:33:11 +01:00
Brian Murphy 47e1e77b58 Alerting : Start of multiprocess coordination work
On alert claim time, query index to make sure alert is still valid and enabled and is the same alert.

Original commit: elastic/x-pack-elasticsearch@72b816b7d1
2014-08-19 13:31:01 +01:00
Brian Murphy 0eea73dd72 Alerting: Scripted triggers and support for aggregations in searches.
This commit adds support for triggers that are scripts:

Query :
````
POST /_search/template/testFilteredAgg
{
  "query" : {
    "filtered" : {
      "query" : {
        "match_all" : {}
     },
     "filter": {
       "range" : {
         "@timestamp" : {
             "gte" : "{{from}}",
             "lt" : "{{to}}"
         }
       }
     }
    }
  },
    "aggs" : {
      "response" : {
        "terms" : {
          "field" : "response",
          "size" : 100
        }
      }
}, "size" : 0  }
````

Trigger Script:
````
POST /_scripts/groovy/testScript
{
  "script" : "ok_count = 0.0;error_count = 0.0;for(bucket in aggregations.response.buckets) {if (bucket.key < 400){ok_count += bucket.doc_count;} else {error_count += bucket.doc_count;}}; return error_count/(ok_count+1) > 0.1;"
}
````

Alert:
````
POST /_alerting/_create/myScriptedAlert
{
    "query" : "testFilteredAgg",
    "schedule" : "05 * * * * ?",
    "trigger" : {
         "script" : {
           "script" : "testScript",
           "script_lang" : "groovy",
           "script_type" : "INDEXED"
         }
     },
    "timeperiod" : "300s",
     "action" : {
         "index" : {
           "index" : "weberrorhistory",
           "type" : "weberrorresult"
         }
     },
    "indices" : [ "logstash*" ],
    "enabled" : true,
    "simple" : false
}
````

If you want to use aggs with your alert you must create a search that contains the timefilter with the params ````{{from}}```` and ````{{to}}```` and set the ````simple```` flag to ````true````.

Original commit: elastic/x-pack-elasticsearch@0430a1bf40
2014-08-18 16:59:49 +01:00
Brian Murphy 4216491824 Alerting : Improve error handling in the RestInterface
This commit improves error handling in the RestHandler. Errors are now
returned to the client.

Original commit: elastic/x-pack-elasticsearch@433e8a57bc
2014-08-18 12:28:48 +01:00
Brian Murphy 14d0bcd589 Alerting add TODO
Original commit: elastic/x-pack-elasticsearch@23cf5fce8b
2014-08-18 12:22:13 +01:00
Brian Murphy 418b9f1a31 Alerting : Add scripted triggers and alert disabling.
This commit adds support for disabling alerts.
This commit adds preliminary support for scripted triggers.

Original commit: elastic/x-pack-elasticsearch@e14a56dbeb
2014-08-18 12:13:39 +01:00
Brian Murphy 4c1c502f80 Alerting : Fix IndexAction
This commit contains fixes to the IndexAlertAction and normalizes the serialization of
Alerts using ToXContent interface.

Original commit: elastic/x-pack-elasticsearch@47325bdd01
2014-08-18 11:23:45 +01:00
Brian Murphy 26e053eaed Alerting : Claim alert runs
This commit add functionality so that multiple nodes running alert plugins won't stand on
each other trying to run the same alerts at the same time.

Original commit: elastic/x-pack-elasticsearch@9c350c0114
2014-08-18 10:27:07 +01:00
Brian Murphy 83287e009a Alerting : Add index action.
This commit adds support for indexing on alert trigger.

Original commit: elastic/x-pack-elasticsearch@d6508ce16d
2014-08-17 13:49:29 +01:00
Brian Murphy d1af9f15fe Alerting : Small fixes.
Fix the constructor for the AlertResult.

Original commit: elastic/x-pack-elasticsearch@0820edaa6a
2014-08-16 17:44:44 +01:00
Brian Murphy 019cdb37d4 Alerting : Add support for history and fix issues around parsing lastRun.
This commit adds a history log for alerts and updates lastRan with the correct time.

Original commit: elastic/x-pack-elasticsearch@49c77f1ef8
2014-08-15 16:46:41 +01:00
Brian Murphy 4c47c8ba9a Alerting : REST endpoints
This commit adds REST endpoints for list/delete/create and fixes refresh.

Original commit: elastic/x-pack-elasticsearch@36e2c15753
2014-08-15 11:45:45 +01:00
Brian Murphy e648cc7f82 Alerting : Update README.md
Add sample alert to README.md and describe the email output.

Original commit: elastic/x-pack-elasticsearch@2b78e26dfd
2014-08-13 18:05:56 +01:00
Brian Murphy b5cb8b3d04 Alerting : Add RestHandler
This commit adds the rest handler and supports /_alerting/_refresh to reload all alerts.

Original commit: elastic/x-pack-elasticsearch@14fadbeeee
2014-08-13 18:00:36 +01:00
Brian Murphy 0d9061b838 Alerting : better email formatting
This commit enables better email formatting.

Original commit: elastic/x-pack-elasticsearch@8be3e3b6d1
2014-08-13 17:05:25 +01:00
Brian Murphy e3250c0366 Alerting : Add time clamping.
This commit adds timestamp clamping on the timeperiod to alerting.
Also adds index setting on alerts.

Original commit: elastic/x-pack-elasticsearch@222cd6eaef
2014-08-13 15:21:55 +01:00
Brian Murphy 88ed7a5624 Alerting : Add parsing and indices.
This commit adds parsing of the triggers and actions, and allows alerts to be restricted to indices.

Original commit: elastic/x-pack-elasticsearch@44a6a51b17
2014-08-13 10:11:51 +01:00
Brian Murphy 940d6402ae Alerting : connect email
The last commit ommited a line that actually sends the email on alert trigger.

Original commit: elastic/x-pack-elasticsearch@24b5c01db8
2014-08-12 19:54:13 +01:00
Brian Murphy 5f84596c92 Alerting : Add support for quartz scheduler.
This commit enables loading of alerts from the .alerts index and adds the
Quartz scheduler.
You can add the following alert :
````
curl -XPOST http://localhost:9200/.alerts/alert/myTestAlert -d '{
    "query" : "myAlertQuery",
    "schedule" : "00 * * * * ?",
    "trigger" : {
         "numberOfEvents" : ">1"
     },
    "timeperiod" : 300,
     "action" : {
         "email" : [ "brian.murphy@elasticsearch.com" ]
     },
    "version" : 1,
    "lastRan" : "2014-05-05T12:12:12.123Z"
}
````
With the following search template:
````
curl -XPOST localhost:9200/_search/template/myAlertQuery -d '{ "template" : { "query" : { "match_all" : {} } } }'
````
This will execute the search every minute and trigger if there is more than one match (which there will be).

Original commit: elastic/x-pack-elasticsearch@708f927914
2014-08-12 18:57:28 +01:00
Brian Murphy 1e6d6b58c9 Alerting Plugin : First commit
Very rough non-functional commit of the alerting plugin.
Please be gentle.

Original commit: elastic/x-pack-elasticsearch@98870d0778
2014-08-12 13:55:10 +01:00