Resource Orchestration Service:ALIYUN::SLS::Alert

構文

{
  "Type": "ALIYUN::SLS::Alert",
  "Properties": {
    "Project": String,
    "Detail": Map
  }
}

プロパティ

詳細構文

"Detail": {
  "Type": String,
  "Description": String,
  "Configuration": Map,
  "State": String,
  "Schedule": Map,
  "DisplayName": String,
  "Name": String
}

詳細プロパティ

構成構文

"Configuration": {
  "Throttling": String,
  "Condition": String,
  "NotificationList": List,
  "NotifyThreshold": Integer,
  "Dashboard": String,
  "QueryList": List,
  "Type": String,
  "GroupConfiguration": Map,
  "NoDataFire": Boolean,
  "Threshold": Integer,
  "SeverityConfigurations": List,
  "Labels": List,
  "AutoAnnotation": Boolean,
  "PolicyConfiguration": Map,
  "SendResolved": Boolean,
  "NoDataSeverity": Integer,
  "Annotations": List,
  "MuteUntil": Integer,
  "JoinConfigurations": List,
  "Version": String
}

構成プロパティ

NotificationList 構文

"NotificationList": [
  {
    "Type": String,
    "MobileList": List,
    "ServiceUri": String,
    "Content": String,
    "EmailList": List,
    "Method": String,
    "Headers": Map
  }
]

NotificationList プロパティ

QueryList 構文

"QueryList": [
  {
    "Query": String,
    "LogStore": String,
    "Start": String,
    "TimeSpanType": String,
    "End": String,
    "ChartTitle": String,
    "DashboardId": String,
    "Region": String,
    "RoleArn": String,
    "StoreType": String,
    "PowerSqlMode": String,
    "Project": String,
    "Store": String
  }
]

QueryList プロパティ

Schedule 構文

"Schedule": {
  "Type": String,
  "Interval": String,
  "Hour": Integer,
  "DayOfWeek": Integer,
  "CronExpression": String,
  "Delay": Integer,
  "RunImmediately": Boolean
}

Schedule プロパティ

SeverityConfigurations 構文

"SeverityConfigurations": {
 "EvalCondition": Map,
 "Severity": Integer
}

SeverityConfigurations プロパティ

EvalCondition 構文

"EvalCondition": {
"Condition": String,
"CountCondition": String
}

EvalCondition プロパティ

Labels 構文

"Labels": [{
 "Value": String,
 "Key": String
}]

Labels プロパティ

GroupConfiguration 構文

"GroupConfiguration": {
 "Type": String,
 "Fields": List
}

GroupConfiguration プロパティ

Annotations 構文

"Annotations": [{
 "Value": String,
 "Key": String
}]

Annotations プロパティ

JoinConfigurations 構文

"JoinConfigurations": {
 "Type": String,
 "Condition": String
}

JoinConfigurations プロパティ

PolicyConfiguration 構文

"PolicyConfiguration": {
"RepeatInterval": String,
 "ActionPolicyId": String,
 "AlertPolicyId": String,
 "UseDefault": Boolean
}

PolicyConfiguration プロパティ

戻り値

Fn::GetAtt

Name：アラート ルールの名前。

例

• YAML 形式

  ROSTemplateFormatVersion: '2015-09-01'
  Parameters: {}
  Resources:
    Alert:
      Type: ALIYUN::SLS::Alert
      Properties:
        Project: TestSlsProject
        Detail:
          DisplayName: ros-test-alert
          Description: test
          Schedule:
            Delay: 1
            Interval: 15m
            Type: FixedRate
            RunImmediately: false
          State: Enabled
          Configuration:
            Throttling: 5m
            NotifyThreshold: 1
            QueryList:
              - End: now
                LogStore: audit-cf5362d1f87754fb29
                ChartTitle: k8s-log-c7b729e7ea122425182133bc2c3ea
                Start: '-15m'
                Query: |-  # クエリステートメント
                  objectRef.resource : "networkpolicies" and verb : create NOT  user.username: node NOT  user.username: serviceaccount NOT  user.username: apiserver NOT  user.username: kube-scheduler NOT  user.username: kube-controller-manager       | SELECT auditID as "Event ID", date_format(from_unixtime(__time__), '%Y-%m-%d %T' ) as "Operation time", "objectRef.name" as "Name", "objectRef.namespace" as "Namespace", "responseStatus.code" as "Status code",
                   CASE WHEN "user.username" != 'kubernetes-admin' then "user.username"
                   WHEN "user.username" = 'kubernetes-admin' and regexp_like("annotations.authorization.k8s.io/reason", 'RoleBinding') then regexp_extract("annotations.authorization.k8s.io/reason", ' to User "(\w+)"', 1) ELSE 'kubernetes-admin' END
                   as "Username",
                  CASE WHEN json_array_length(sourceIPs) = 1 then json_format(json_array_get(sourceIPs, 0)) ELSE  sourceIPs END
                  as "Source IP address" order by "Operation time"
                TimeSpanType: Custom
            Dashboard: audit-cf5362d1f87754fb4a_network_policy_op_cn
            NotificationList:
              - Content: Message
                ServiceUri: http://xxxx
                Type: DingTalk
              - Content: Email Message # Eメールメッセージ
                EmailList:
                  - abc@test.com
                Type: Email
              - MobileList:
                  - 132373830xx
                Content: Cellphone message # 携帯電話メッセージ
                Type: SMS
            Condition: total  > 1
          Type: Alert
          Name: alert_2
  Outputs:
    Name:
      Description: Alert name. # アラート名
      Value:
        Fn::GetAtt:
          - Alert
          - Name

• JSON 形式

  {
    "ROSTemplateFormatVersion": "2015-09-01",
    "Parameters": {
    },
    "Resources": {
      "Alert": {
        "Type": "ALIYUN::SLS::Alert",
        "Properties": {
          "Project": "TestSlsProject",
          "Detail": {
            "DisplayName": "ros-test-alert",
            "Description": "test",
            "Schedule": {
              "Delay": 1,
              "Interval": "15m",
              "Type": "FixedRate",
              "RunImmediately": false
            },
            "State": "Enabled",
            "Configuration": {
              "Throttling": "5m",
              "NotifyThreshold": 1,
              "QueryList": [
                {
                  "End": "now",
                  "LogStore": "audit-cf5362d1f87754fb29",
                  "ChartTitle": "k8s-log-c7b729e7ea122425182133bc2c3ea",
                  "Start": "-15m",
                  "Query": "objectRef.resource : \"networkpolicies\" and verb : create NOT  user.username: node NOT  user.username: serviceaccount NOT  user.username: apiserver NOT  user.username: kube-scheduler NOT  user.username: kube-controller-manager       | SELECT auditID as \"Event ID\", date_format(from_unixtime(__time__), '%Y-%m-%d %T' ) as \"Operation time\", \"objectRef.name\" as \"Name\", \"objectRef.namespace\" as \"Namespace\", \"responseStatus.code\" as \"Status code\",\n CASE WHEN \"user.username\" != 'kubernetes-admin' then \"user.username\"\n WHEN \"user.username\" = 'kubernetes-admin' and regexp_like(\"annotations.authorization.k8s.io/reason\", 'RoleBinding') then regexp_extract(\"annotations.authorization.k8s.io/reason\", ' to User \"(\\w+)\"', 1) ELSE 'kubernetes-admin' END  \n as \"Username\", \nCASE WHEN json_array_length(sourceIPs) = 1 then json_format(json_array_get(sourceIPs, 0)) ELSE  sourceIPs END\nas \"Source IP address\" order by \"Operation time\"", // クエリステートメント
                  "TimeSpanType": "Custom"
                }
              ],
              "Dashboard": "audit-cf5362d1f87754fb4a_network_policy_op_cn",
              "NotificationList": [
                {
                  "Content": "Message",
                  "ServiceUri": "http://xxxx",
                  "Type": "DingTalk"
                },
                {
                  "Content": "Email Message", // Eメールメッセージ
                  "EmailList": [
                    "abc@test.com"
                  ],
                  "Type": "Email"
                },
                {
                  "MobileList": [
                    "132373830xx"
                  ],
                  "Content": "Cellphone message", // 携帯電話メッセージ
                  "Type": "SMS"
                }
              ],
              "Condition": "total  > 1"
            },
            "Type": "Alert",
            "Name": "alert_2"
          }
        }
      }
    },
    "Outputs": {
      "Name": {
        "Description": "Alert name.", // アラート名
        "Value": {
          "Fn::GetAtt": [
            "Alert",
            "Name"
          ]
        }
      }
    }
  }