Elasticsearch:Configure a DingTalk robot to receive X-Pack Watcher alerts

Configure the NGINX proxy

1. Install NGINX on the ECS instance.

2. Update the nginx.conf file. Replace the server section with the following configuration. Before saving, replace <Webhook URL> with the DingTalk chatbot webhook URL you copied in Step 1.

   server
     {
       listen 8080; # Listener port
       server_name localhost; # Domain name
       index index.html index.htm index.php;
       root /usr/local/webserver/nginx/html; # Site folder
         location ~ .*\.(php|php5)?$
       {
         #fastcgi_pass unix:/tmp/php-cgi.sock;
         fastcgi_pass 127.0.0.1:9000;
         fastcgi_index index.php;
         include fastcgi.conf;
       }
       location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|ico)$
       {
         expires 30d;
         # access_log off;
       }
       location / {
         proxy_pass <Webhook URL>;
       }
       location ~ .*\.(js|css)?$
       {
         expires 15d;
         # access_log off;
       }
       access_log off;
     }

3. Reload the configuration and restart NGINX.

   /usr/local/webserver/nginx/sbin/nginx -s reload   # Reload the configuration file
   /usr/local/webserver/nginx/sbin/nginx -s reopen   # Restart NGINX

Configure the ECS security group

Add an inbound rule to allow Elasticsearch instance nodes to send traffic to the NGINX proxy.

1. Log on to the Alibaba Cloud ECS console.Alibaba Cloud ECS console

2. In the left-side navigation pane, choose Instances & Images > Instances.

3. Click the name of your ECS instance.

4. Click the Security Groups tab, then click the name of the security group.

5. On the Inbound tab, click Add Rule and set the following parameters.

   Parameter	Description
   Action	Select Allow.
   Priority	Keep the default value.
   Protocol	Select Custom TCP.
   Source	Enter the IP addresses of all nodes in your Elasticsearch instance. See View basic information about nodes to get these IP addresses.
   Destination (Current Instance)	Enter a commonly used port. This topic uses port 8080 as an example.
   Description	Enter a description for the rule.

6. Click OK.

How a watch works

A watch consists of four components that define when to check, what to look for, when to act, and what to do:

• Trigger: defines when the watch runs. Each watch must have a trigger.

• Input: specifies the query to run against the monitored index when the watch is triggered.

• Condition: defines the condition that must be met for the actions to run.

• Actions: defines what happens when the condition is met — for example, sending a webhook request to your DingTalk chatbot.

Create a watch

1. Log on to the Kibana console of your Elasticsearch cluster. For more information, see Log on to the Kibana console.

   Note

   The following example uses an Elasticsearch V6.7.0 cluster. Steps may differ for other versions. Refer to the actual Kibana console for your version.

2. In the left-side navigation pane, click Dev Tools.

3. In the Console, run the following command to create a watch named log_error_watch. This watch queries the logs index every 10 seconds. If more than 0 error logs are found, it sends an alert message to your DingTalk chatbot via the NGINX proxy. Before running the command, replace <yourAddress> in the url field with the address for your network architecture. See the parameter table below for details.

   Note

   If you see No handler found for uri [/_xpack/watcher/watch/log_error_watch_2] and method [PUT], X-Pack Watcher is not enabled on your instance. Enable it and run the command again. For more information, see Configure YML parameters.

   `url` parameter by network architecture

   Network architecture	Value
   New network architecture	The endpoint domain name from your PrivateLink configuration. Requests are forwarded through this endpoint. To get the endpoint domain name, see Configure private network peering for Alibaba Cloud Elasticsearch.
   Old network architecture	The IP address of the NGINX proxy on your ECS instance (requests are forwarded to DingTalk over the internet by the NGINX proxy in the same VPC), or the DingTalk chatbot webhook URL directly.

   PUT _xpack/watcher/watch/log_error_watch
   {
     "trigger": {
       "schedule": {
         "interval": "10s"
       }
     },
     "input": {
       "search": {
         "request": {
           "indices": ["logs"],
           "body": {
             "query": {
               "match": {
                 "message": "error"
               }
             }
           }
         }
       }
     },
     "condition": {
       "compare": {
         "ctx.payload.hits.total": {
           "gt": 0
         }
       }
     },
     "actions" : {
     "test_issue" : {
       "webhook" : {
         "method" : "POST",
         "url" : "http://<yourAddress>:8080",
         "body" : "{\"msgtype\": \"text\", \"text\": { \"content\": \"An error log has appeared. Please handle it as soon as possible.\"}}"
       }
     }
   }
   }

   `body` parameter Configure the DingTalk message payload based on your chatbot's security settings. If you configured Custom Keywords in Step 1 with the keyword error, the content field must include error for the chatbot to push the alert.