You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Aug 16, 2022. It is now read-only.
Copy file name to clipboardExpand all lines: docs/alerting/monitors.md
+31-2Lines changed: 31 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -53,6 +53,35 @@ Destination | A reusable location for an action, such as Amazon Chime, Slack, or
53
53
54
54
- Query definition gives you flexibility in terms of what you query for (using [the Elasticsearch query DSL](../../elasticsearch/full-text)) and how you evaluate the results of that query (Painless scripting).
55
55
56
+
You can even filter query results using `{% raw %}{{period_start}}{% endraw %}` and `{% raw %}{{period_end}}{% endraw %}`:
57
+
58
+
```json
59
+
{
60
+
"size": 0,
61
+
"query": {
62
+
"bool": {
63
+
"filter": [{
64
+
"range": {
65
+
"timestamp": {
66
+
"from": "{% raw %}{{period_end}}{% endraw %}||-1h",
67
+
"to": "{% raw %}{{period_end}}{% endraw %}",
68
+
"include_lower": true,
69
+
"include_upper": true,
70
+
"format": "epoch_millis",
71
+
"boost": 1
72
+
}
73
+
}
74
+
}],
75
+
"adjust_pure_negative": true,
76
+
"boost": 1
77
+
}
78
+
},
79
+
"aggregations": {}
80
+
}
81
+
```
82
+
83
+
"Start"and "end" refer to the interval at which the monitor runs. See [Available variables](#available-variables).
84
+
56
85
1. To define a monitor visually, choose **Define using visual graph**. Then choose an aggregation (for example, `count()` or `average()`), a set of documents, and a timeframe. Visual definition works well for most monitors.
57
86
58
87
To use a query, choose **Define using extraction query**, add your query (using [the Elasticsearch query DSL](../../elasticsearch/full-text)), and test it using the **Run** button.
@@ -82,7 +111,7 @@ The line moves up and down as you increase and decrease the threshold. Once this
82
111
83
112
For **Trigger condition**, specify a Painless script that returns true or false. Painless is the default Elasticsearch scripting language and has a syntax similar to Groovy.
84
113
85
-
Trigger condition scripts revolve around the `ctx.results[0]` variable, which corresponds to the extraction query response. For example, your script might reference `ctx.results[0].hits.total` or `ctx.results[0].hits.hits[i]._source.error_code`.
114
+
Trigger condition scripts revolve around the `ctx.results[0]` variable, which corresponds to the extraction query response. For example, your script might reference `ctx.results[0].hits.total.value` or `ctx.results[0].hits.hits[i]._source.error_code`.
86
115
87
116
A return value of true means the trigger condition has been met, and the trigger should execute its actions. Test your script using the **Run** button.
88
117
@@ -98,7 +127,7 @@ These scripts are Painless, not Groovy, but calling them Groovy in Jekyll gets u
98
127
99
128
```groovy
100
129
// Evaluates to true if the query returned any documents
@@ -46,21 +46,21 @@ The document is optional, because `delete` actions do not require a document. Th
46
46
Elasticsearch features automatic index creation when you add a document to an index that doesn't already exist. It also features automatic ID generation if you don't specify an ID in the request. This simple example automatically creates the movies index, indexes the document, and assigns it a unique ID:
47
47
48
48
```json
49
-
POST elasticsearch_domain/movies/_doc
49
+
POST cluster_endpoint/movies/_doc
50
50
{"title": "Spirited Away"}
51
51
```
52
52
53
53
Automatic ID generation has a clear downside: because the indexing request didn't specify a document ID, you can't easily update the document at a later time. To specify an ID of 1, use the following request, and note the use of PUT instead of POST:
54
54
55
55
```json
56
-
PUT elasticsearch_domain/movies/_doc/1
56
+
PUT cluster_endpoint/movies/_doc/1
57
57
{"title": "Spirited Away"}
58
58
```
59
59
60
-
Indices default to five primary shards and one replica. If you want to specify non-default settings, create the index before adding documents:
60
+
Indices default to one primary shard and one replica. If you want to specify non-default settings, create the index before adding documents:
Copy file name to clipboardExpand all lines: docs/elasticsearch/snapshot-restore.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -101,7 +101,7 @@ readonly | Whether the repository is read-only. Useful when migrating from one c
101
101
If you're using the Docker installation, see [Run with custom plugins](../../install/docker/#run-with-custom-plugins). Your `Dockerfile` should look something like this:
@@ -121,7 +140,7 @@ If you encounter any `File /usr/share/elasticsearch/config/elasticsearch.yml has
121
140
122
141
## Change passwords for read-only users
123
142
124
-
After the cluster starts, change the passwords for the [read-only user accounts](../../security-configuration/api/#read-only-and-hidden-resources): `admin` and `kibanaserver`.
143
+
After the cluster starts, change the passwords for the [read-only user accounts](../../security-access-control/api/#read-only-and-hidden-resources): `admin` and `kibanaserver`.
125
144
126
145
- The `admin` user has full privileges on the cluster.
127
146
- `kibanaserver`user has certain permissions to the `.kibana` index that let it perform management tasks like setting index patterns and retrieving visualizations. This user, or one just like it, is required for Kibana to work properly with the Security plugin. We recommend just using `kibanaserver`.
You can perform the same operation in `docker-compose.yml` using a relative path:
@@ -199,15 +210,15 @@ vm.max_map_count=262144
199
210
200
211
Then run `sudo sysctl -p` to reload.
201
212
202
-
The `docker-compose.yml` file above also contains several key settings: `bootstrap.memory_lock=true`, `ES_JAVA_OPTS=-Xms512m -Xmx512m`, and `9600:9600`. Respectively, these settings disable memory swapping (along with `memlock`), set the size of the Java heap (we recommend half of system RAM), and allow you to access Performance Analyzer on port 9600.
213
+
The `docker-compose.yml` file above also contains several key settings: `bootstrap.memory_lock=true`, `ES_JAVA_OPTS=-Xms512m -Xmx512m`, `nofile 65536` and `port 9600`. Respectively, these settings disable memory swapping (along with `memlock`), set the size of the Java heap (we recommend half of system RAM), set a limit of 65536 open files for the Elasticsearch user, and allow you to access Performance Analyzer on port 9600.
203
214
204
215
205
216
## Run with custom plugins
206
217
207
218
To run the image with a custom plugin, first create a [`Dockerfile`](https://docs.docker.com/engine/reference/builder/):
208
219
209
220
```
210
-
FROM amazon/opendistro-for-elasticsearch:0.9.0
221
+
FROM amazon/opendistro-for-elasticsearch:1.0.0
211
222
RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch <plugin-name-or-url>
You can also use a `Dockerfile` to pass your own certificates for use with the [Security](../../security-configuration/) plugin, similar to the `-v` argument in [Configure Elasticsearch](#configure-elasticsearch):
-[PerfTop client for Performance Analyzer](../../pa/)
14
14
-[Job Scheduler plugin](https://github.com/opendistro-for-elasticsearch/job-scheduler), an extensible plugin for running periodic jobs
15
+
-[Alerting CLI](https://github.com/mihirsoni/odfe-monitor-cli), a command line interface that lets you use YAML files to manage your Open Distro for Elasticsearch monitors
After installing the Security plugin, you can run `sudo sh /usr/share/elasticsearch/plugins/opendistro_security/tools/install_demo_configuration.sh` to quickly get started with demo certificates. Otherwise, you must configure it manually.
@@ -27,22 +27,22 @@ After installing the Security plugin, you can run `sudo sh /usr/share/elasticsea
Performance Analyzer requires so many additional configuration steps that we don't recommend installing it as a standalone plugin. After installing the plugin:
0 commit comments