How to Setup custom alerting in kibana for logs

Rahul_Ravichandran · May 18, 2020, 12:16pm

Hey Guys,
I have setup an Alert for my backup Monitoring where in message Field if it says "Network related issue"
with a threshold reached it gives me an alert. The alert contains the contents severity and the message from the message field. I also have server IP field which contains the IP.

My question is, How do i include my server IP here along with the message field to be alerted to my mail.
is there any custom way to set it up.

tylersmalley · May 19, 2020, 9:24pm

Are you using Watcher?

Rahul_Ravichandran · May 20, 2020, 10:00am

Hey tyler
I am not using watcher

tylersmalley · May 20, 2020, 1:39pm

What are you using to manage the alerts?

Rahul_Ravichandran · May 20, 2020, 3:20pm

Actually I am using Elasticsearch opensource provided in AWS, for alerting we intergrate with the AWS SNS and send the mail.

tylersmalley · May 20, 2020, 3:57pm

You will have to reach out to them about their alerting system and how to include additional information in the message.

Rahul_Ravichandran · May 20, 2020, 4:52pm

Thanks for you concern. Actually , I dint really dig deep into AWS about their options but, I found an another way by using ElastAlert, I was able to achieve what i was up to.

Vikas_Rathore · June 16, 2020, 3:51pm

Hey Rahul, I am having the exact same issue. how did you manage to add alert on aws elastic serarch? any document?

Rahul_Ravichandran · June 17, 2020, 8:37am

Hey Vikas,
I used ElastAlert To create a custom alert rule. Here are the links which i followed

github.com

justmeandopensource/elk/blob/master/docs/elastic-kibana-filebeat-elastalert-notes.md

### Run Elasticsearch & Kibana as docker containers
```
git clone https://github.com/justmeandopensource/elk
cd elk/docker
mv docker-compose-v7.1.1.yml docker-compose.yml
sudo sysctl -w vm.max_map_count=262144
docker-compose up -d
```
### Install Filebeat on client machine (Ubuntu 18.04)
```
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install filebeat
```
### Configure Filebeat and enable system module
Edit filebeat configuration and update kibana and elasticsearch url
```
sudo vi /etc/filebeat/filebeat.yml
```

This file has been truncated. show original

you can refer the YouTube for the steps to installation and GitHub for the commands.

system · July 15, 2020, 8:37am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.