elk告警 elastalert 规则配置 terms whitelist {#articleContentId}

elk告警 elastalert 规则配置 terms whitelist_elastalert term-CSDN博客

name: API错误响应(status >= 400)
type: whitelist
compare_key: "uri"
ignore_null: true
whitelist:
    - /v3/connect/config
    - \/
type: frequency
index: nginx-ingress-logs*
num_events: 5
timeframe:
minutes: 1
filter:

range:
status:
from: 400
to: 599
include: ["_index","uri","remote_addr","http_x_forwarded_for","status","request_time"]