ALIYUN::SLS::Alert

语法

{
  "Type": "ALIYUN::SLS::Alert",
  "Properties": {
    "Project": String,
    "Detail": Map
  }
}

属性

Detail语法

"Detail": {
  "Type": String,
  "Description": String,
  "Configuration": Map,
  "State": String,
  "Schedule": Map,
  "DisplayName": String,
  "Name": String
}

Detail属性

Configuration语法

"Configuration": {
  "Throttling": String,
  "Condition": String,
  "NotificationList": List,
  "NotifyThreshold": Integer,
  "Dashboard": String,
  "QueryList": List,
  "Type": String,
  "GroupConfiguration": Map,
  "NoDataFire": Boolean,
  "Threshold": Integer,
  "SeverityConfigurations": List,
  "Labels": List,
  "AutoAnnotation": Boolean,
  "PolicyConfiguration": Map,
  "SendResolved": Boolean,
  "NoDataSeverity": Integer,
  "Annotations": List,
  "MuteUntil": Integer,
  "JoinConfigurations": List,
  "Version": String
}

Configuration属性

NotificationList语法

"NotificationList": [
  {
    "Type": String,
    "MobileList": List,
    "ServiceUri": String,
    "Content": String,
    "EmailList": List,
    "Method": String,
    "Headers": Map
  }
]

NotificationList属性

QueryList语法

"QueryList": [
  {
    "Query": String,
    "LogStore": String,
    "Start": String,
    "TimeSpanType": String,
    "End": String,
    "ChartTitle": String,
    "DashboardId": String,
    "Region": String,
    "RoleArn": String,
    "StoreType": String,
    "PowerSqlMode": String,
    "Project": String,
    "Store": String
  }
]

QueryList属性

Schedule语法

"Schedule": {
  "Type": String,
  "Interval": String,
  "Hour": Integer,
  "DayOfWeek": Integer,
  "CronExpression": String,
  "Delay": Integer,
  "RunImmediately": Boolean
}

Schedule属性

SeverityConfigurations语法

"SeverityConfigurations": {
  "EvalCondition": Map,
  "Severity": Integer
}

SeverityConfigurations属性

EvalCondition语法

"EvalCondition": {
 "Condition": String,
 "CountCondition": String
}

EvalCondition属性

Labels语法

"Labels": [{
  "Value": String,
  "Key": String
}]

Labels属性

GroupConfiguration语法

"GroupConfiguration": {
   "Type": String,
   "Fields": List
}

GroupConfiguration属性

Annotations语法

"Annotations": [{
  "Value": String,
  "Key": String
}]

Annotations属性

JoinConfigurations语法

"JoinConfigurations": {
   "Type": String,
   "Condition": String
}

JoinConfigurations属性

PolicyConfiguration语法

"PolicyConfiguration": {
  "RepeatInterval": String,
  "ActionPolicyId": String,
  "AlertPolicyId": String,
  "UseDefault": Boolean
}

PolicyConfiguration属性

返回值

Fn::GetAtt

Name：告警名称。

示例

• YAML格式

  ROSTemplateFormatVersion: '2015-09-01'
  Parameters: {}
  Resources:
    Alert:
      Type: ALIYUN::SLS::Alert
      Properties:
        Project: TestSlsProject
        Detail:
          DisplayName: ros-test-alert
          Description: test
          Schedule:
            Delay: 1
            Interval: 15m
            Type: FixedRate
            RunImmediately: false
          State: Enabled
          Configuration:
            Throttling: 5m
            NotifyThreshold: 1
            QueryList:
              - End: now
                LogStore: audit-cf5362d1f87754fb29
                ChartTitle: k8s-log-c7b729e7ea122425182133bc2c3ea
                Start: '-15m'
                Query: |-
                  objectRef.resource : "networkpolicies" and verb : create NOT  user.username: node NOT  user.username: serviceaccount NOT  user.username: apiserver NOT  user.username: kube-scheduler NOT  user.username: kube-controller-manager       | SELECT auditID as "事件ID", date_format(from_unixtime(__time__), '%Y-%m-%d %T' ) as "操作时间", "objectRef.name" as "Name", "objectRef.namespace" as "Namespace", "responseStatus.code" as "状态码",
                   CASE WHEN "user.username" != 'kubernetes-admin' then "user.username"
                   WHEN "user.username" = 'kubernetes-admin' and regexp_like("annotations.authorization.k8s.io/reason", 'RoleBinding') then regexp_extract("annotations.authorization.k8s.io/reason", ' to User "(\w+)"', 1) ELSE 'kubernetes-admin' END
                   as "操作账号",
                  CASE WHEN json_array_length(sourceIPs) = 1 then json_format(json_array_get(sourceIPs, 0)) ELSE  sourceIPs END
                  as "源地址" order by "操作时间"
                TimeSpanType: Custom
            Dashboard: audit-cf5362d1f87754fb4a_network_policy_op_cn
            NotificationList:
              - Content: Message
                ServiceUri: http://xxxx
                Type: DingTalk
              - Content: Email Message
                EmailList:
                  - abc@test.com
                Type: Email
              - MobileList:
                  - 132373830xx
                Content: Cellphone message
                Type: SMS
            Condition: total  > 1
          Type: Alert
          Name: alert_2
  Outputs:
    Name:
      Description: Alert name.
      Value:
        Fn::GetAtt:
          - Alert
          - Name

• JSON格式

  {
    "ROSTemplateFormatVersion": "2015-09-01",
    "Parameters": {
    },
    "Resources": {
      "Alert": {
        "Type": "ALIYUN::SLS::Alert",
        "Properties": {
          "Project": "TestSlsProject",
          "Detail": {
            "DisplayName": "ros-test-alert",
            "Description": "test",
            "Schedule": {
              "Delay": 1,
              "Interval": "15m",
              "Type": "FixedRate",
              "RunImmediately": false
            },
            "State": "Enabled",
            "Configuration": {
              "Throttling": "5m",
              "NotifyThreshold": 1,
              "QueryList": [
                {
                  "End": "now",
                  "LogStore": "audit-cf5362d1f87754fb29",
                  "ChartTitle": "k8s-log-c7b729e7ea122425182133bc2c3ea",
                  "Start": "-15m",
                  "Query": "objectRef.resource : \"networkpolicies\" and verb : create NOT  user.username: node NOT  user.username: serviceaccount NOT  user.username: apiserver NOT  user.username: kube-scheduler NOT  user.username: kube-controller-manager       | SELECT auditID as \"事件ID\", date_format(from_unixtime(__time__), '%Y-%m-%d %T' ) as \"操作时间\", \"objectRef.name\" as \"Name\", \"objectRef.namespace\" as \"Namespace\", \"responseStatus.code\" as \"状态码\",\n CASE WHEN \"user.username\" != 'kubernetes-admin' then \"user.username\"\n WHEN \"user.username\" = 'kubernetes-admin' and regexp_like(\"annotations.authorization.k8s.io/reason\", 'RoleBinding') then regexp_extract(\"annotations.authorization.k8s.io/reason\", ' to User \"(\\w+)\"', 1) ELSE 'kubernetes-admin' END  \n as \"操作账号\", \nCASE WHEN json_array_length(sourceIPs) = 1 then json_format(json_array_get(sourceIPs, 0)) ELSE  sourceIPs END\nas \"源地址\" order by \"操作时间\"",
                  "TimeSpanType": "Custom"
                }
              ],
              "Dashboard": "audit-cf5362d1f87754fb4a_network_policy_op_cn",
              "NotificationList": [
                {
                  "Content": "Message",
                  "ServiceUri": "http://xxxx",
                  "Type": "DingTalk"
                },
                {
                  "Content": "Email Message",
                  "EmailList": [
                    "abc@test.com"
                  ],
                  "Type": "Email"
                },
                {
                  "MobileList": [
                    "132373830xx"
                  ],
                  "Content": "Cellphone message",
                  "Type": "SMS"
                }
              ],
              "Condition": "total  > 1"
            },
            "Type": "Alert",
            "Name": "alert_2"
          }
        }
      }
    },
    "Outputs": {
      "Name": {
        "Description": "Alert name.",
        "Value": {
          "Fn::GetAtt": [
            "Alert",
            "Name"
          ]
        }
      }
    }
  }