elasticsearch - How do I deal with timestamp in bosun configuration? -
i'm trying insert alert in elasticsearch bosun don't know how fill variable $timestamp
(have @ example) present time. can use functions in bosun.conf
? i'd now()
. can me, please?
this extract of example configuration:
macro m1 { $timestamp = **???** } notification http_crit { macro = m1 post = http://xxxxxxx:9200/alerts/http/ body = {"@timestamp":$timestamp,"level":"critical","alert_name":"my_alert"} next = http_crit timeout = 1m } alert http { template = elastic $testhttp = lscount("logstash", "", "_type:stat_http,http_response:200", "1m", "5m", "") $testavghttp = avg($testhttp) crit = $testavghttp < 100 critnotification = http_crit }
we use .state.touched.format
renamed .last.time.format
in master branch. format string go time format, , have print correct format elastic expecting.
template elastic { subject = `time: {{.state.touched.format "15:04:05utc"}}` } //changed on 2016 feb 01 template elastic { subject = `time: {{.last.time.format "15:04:05utc"}}` }
which when rendered like:
time: 01:30:13utc
Comments
Post a Comment