Elasticsearch:Configure a WeCom chatbot to receive alert notifications from X-Pack Watcher

Step 1: Configure an NGINX proxy and configure a security group rule for the ECS instance

1. Configure an NGINX proxy on the ECS instance.

   X-Pack Watcher sends alerts to an NGINX proxy on your ECS instance, which then forwards them to DingTalk or WeCom.

   1. Install NGINX on the ECS instance.

   2. Configure the nginx.conf file.

      Replace the server section in the nginx.conf file with the following configuration.

      server {
              listen 8080;
              server_name _;
              root /usr/share/nginx/html;
              # Load configuration files for the default server block.
              include /etc/nginx/default.d/*.conf;
      
                location / {
                  proxy_pass <Webhook URL of your WeCom chatbot>;
                }
              error_page 404 /404.html;
                  location = /40x.html {
              }
              error_page 500 502 503 504 /50x.html;
                  location = /50x.html {
              }
          }

      Replace <Webhook URL of the WeCom chatbot> with the webhook URL of the WeCom chatbot that you configured to receive alert notifications.

   3. Reload the configuration file and restart NGINX.

      /usr/local/webserver/nginx/sbin/nginx -s reload            # Reload the configuration file
      /usr/local/webserver/nginx/sbin/nginx -s reopen            # Restart NGINX

2. Configure the ECS security group.

   Allow inbound traffic from your Alibaba Cloud Elasticsearch instance to the NGINX proxy on the ECS instance.

   1. Log on to the Alibaba Cloud ECS console.

   2. In the left-side navigation pane, choose Instances & Images > Cluster.

   3. On the Cluster page, click the name of the target instance.

   4. Click the Security Group tab.

   5. On the Security Groups tab, click the name of the target security group.

   6. On the Inbound tab, click Add Rule.

   7. Configure the parameters.

      Parameter	Description
      Action	Select Permitted.
      Priority	Keep the default value.
      Protocol	Select Custom TCP.
      Access Source	Enter the IP addresses of all nodes in your Alibaba Cloud Elasticsearch instance. Note To get the IP addresses of the nodes, see View basic information about nodes.
      Destination	Enter the port that NGINX is configured to listen on. This topic uses port 8080 as an example.
      Description	Enter a description for the rule.

   8. Click OK.

Step 2: Configure a watch for alerting

1. Log on to the Kibana console of your Elasticsearch cluster.

   For instructions, see Log on to the Kibana console.

   Note

   Examples here use Elasticsearch V6.7.0. Operations may vary slightly for other versions.

2. In the left navigation menu, choose Management > Dev Tools.

3. On the Console, run the following command to create a watch.

   In this example, a watch named developer_count_watch is created to search the zl-testgaes index for the developer field every 10 seconds. If the value of the developer field is Nintendo and the number of occurrences of the developer field is more than 158,974, an alert is triggered.

   PUT _xpack/watcher/watch/developer_count_watch
   {
     "trigger": {
       "schedule": {
         "interval": "10s"
       }
     },
     "input": {
       "search": {
         "request": {
           "indices": ["zl-testgaes"],
           "body": {
             "query": {
       "bool": {
         "must": [
           {"match": 
            {
              "developer" : "Nintendo"    
           }
           },
           {
           "range": {
             "year_of_release": {
               "gte": "2011-09-20T16:00:00.000Z",
               "lte": "2011-12-31T16:00:00.000Z"
                     }
                 }
           }
         ]
       } 
     }
           }
         }
       }
     },
     "condition": {
       "compare": {
         "ctx.payload.hits.total": {
           "gt": 158974
         }
       }
     },
     "actions" : {
     "test_issue" : {
       "webhook" : {
         "method" : "POST",
         "url" : "http://<yourAddress>:8080",
         "body" : "{\"msgtype\": \"text\", \"text\": { \"content\": \"developer is Nintendo，More than 158974\"}}"
       }
     }
   }
   }

   Table 1. Parameters

   Parameter	Network architecture	Description
   url	New network architecture	The domain name of the endpoint. Requests are forwarded based on the domain name. For more information about how to obtain the domain name of an endpoint, see Configure a private connection for an Elasticsearch cluster.
   	Original network architecture	Set this parameter to one of the following items: IP address of the NGINX proxy. In this case, requests are forwarded over the Internet by using the NGINX proxy that resides in the same VPC as the Elasticsearch cluster. The webhook URL of the WeCom chatbot.

   Note

   If you see the error No handler found for uri [/_xpack/watcher/watch/log_error_watch_2] and method [PUT] when you run the command, X-Pack Watcher is not enabled for your Alibaba Cloud Elasticsearch instance. You must enable it and then run the command again. For more information, see Configure YML parameters.

Step 3: View the alert notifications

DELETE _xpack/watcher/watch/developer_count_watch