elk告警 elastalert 规则配置 terms whitelist {#articleContentId}

elk告警 elastalert 规则配置 terms whitelist_elastalert term-CSDN博客

name: API错误响应(status >= 400)
type: whitelist
compare_key: "uri"
ignore_null: true
whitelist:
    - /v3/connect/config
    - \/

type: frequency
index: nginx-ingress-logs*
num_events: 5
timeframe:
    minutes: 1

filter:
- range:
    status:
      from: 400
      to: 599
include: ["_index","uri","remote_addr","http_x_forwarded_for","status","request_time"]