I am using ELK (logstash, ES, Kibana) stack for log analysis and Riemann
for alerting. I have logs in which *users *is one of the fields parsed by
logstash and I send the events to riemann from riemann output plugin.
Logstash:
riemann {
riemann_event => {
"service" => "logins"
"users" => "%{user}"
}
}
So users values will be like: root, sid, abc, root, sid, def, etc....
So I split stream by user i.e one stream for each unique user. Now, I want
to alert when number of *unique users* count go more than 3. I wrote the
following but it's achieving my purpose.
Riemann:
(streams
(where (service "logins")
(by :unique_user
(moving-time-window 3600
(smap (fn [events]
(let
[users (count events)]
(if (> users 3)
(email "[email protected]")
))))))))
I am new to Riemann and clojure. Any help is appreciated.
--
You received this message because you are subscribed to the Google
Groups "Clojure" group.
To post to this group, send email to [email protected]
Note that posts from new members are moderated - please be patient with your
first post.
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/clojure?hl=en
---
You received this message because you are subscribed to the Google Groups
"Clojure" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
