即使满足警报条件，ElastAlert范围查询也不会发送警报电子邮件

Question

我按照下面的步骤设置了我的ElastAlert规则。

MyRangeAlert.yaml: |-
---
name: MyRangeAlert
type: frequency
limit_execution: "0/8 * * * *"
index: myindex-*
num_events: 1
timeframe:
minutes: 15
filter:
- query:
query_string:
query: "request.keyword: "/api/rest/cms/content/cited-by/" AND response:503"
- range:
field3:
from: 150
to: 200
alert:
- "email"
email:
- "[e-mail]"
from_addr: "[e-mail]"
alert_subject: " High Response Time at {0}."
alert_subject_args:
- "@timestamp"
alert_text: "Average response {0} seconds observed in last 20 minutes."
alert_text_args:
- field3
alert_text_type: alert_text_only

然后我插入数据以满足条件。

PUT MyRangeAlert/_doc/501
{
"request.keyword": "/api/rest/cms/content/cited-by/",
"response": 503,
"tags": "account_compromised",
"alert-triggered": true,
"field3": 156,
"city": "Kansas",
"name": "sameera",
"description": "desccrption 1032",
"@timestamp": "2021-01-06T11:31:23+0000"
}

然而。警报没有发送电子邮件。我删除了范围，然后它开始发送警报。任何建议或半回答也非常感谢。

Answer 1

在field3前面添加一个空格后出现缩进错误。

filter:
- query:
query_string:
query: "request.keyword: "/api/rest/cms/content/cited-by/" AND response:503"
- range:
field3:
from: 150
to: 200