elastalert rule example 2

아래 룰은 AP의 콘솔 접속 시 발송하는 메시지 룰입니다.

name: ap_login_fail

type: any

index: "logstash-ap*"

filter:
- query_string:
    query: reason:"logon failed for invalid username"

doc_type: _doc

alert:
- "slack"

slack:
slack_webhook_url: "https://hooks.slack.com/services/------------------------"
slack_username_override: "ElastAlert-Bot"
slack_channel_override: "#security_alert"
slack_title: AP_LOGIN_FAIL
slack_msg_color: "warning"

alert_text: "AP_LOGIN_FAIL: {0} / 접속자IP: {1}"
alert_text_type: "alert_text_only"
alert_text_args: ["ip_or_host", "source_ip"]