ElastAlert Tutorial chapter 3: Introduction to ElastAlert
Log alarm is a very important technology. It monitors logs and alarms logs when certain content is found. It is an independent and non-invasive technology.
The advantage of log alarms is that alarm rules can be independent of application programs. Application programs only need to use a log framework such as Log4j to print logs. The log alarm engine collects and analyzes these logs and sends alarms when matching rules.
In this tutorial, we present a very good open source logging alert software called ElastAlert.
Elastalert process
Elastalert generates alarms by:
Graph LR Log File --> FileBeat FileBeat --> ElastSearch ElastSearch --> ElastAlert ElastAlert --> Alarm- Logs are printed to a local file
- Collect logs from local files using FileBeat
- Filebeat sends logs to ElastSearch
- Elastsearch to log alarms
Elastalert is something to learn
To use ElastAlert flexibly, you need to use some of the following techniques:
- Docker: Installing ELk with Docker is easier
- A simple use of ElastSearch
- Filebeat: Simple use of the log collector
Details are reproduced from
Elastalert tutorial