| 1 | # you can disable an alarm notification by setting the 'to' line to: silent |
| 2 | |
| 3 | # 'red' is a threshold, can't lookup the 'red' dimension - using simple pattern is a workaround. |
| 4 | |
| 5 | template: elasticsearch_cluster_health_status_red |
| 6 | on: elasticsearch.cluster_health_status |
| 7 | class: Errors |
| 8 | type: SearchEngine |
| 9 | component: Elasticsearch |
| 10 | lookup: average -5s unaligned of *ed |
| 11 | every: 10s |
| 12 | units: status |
| 13 | crit: $this == 1 |
| 14 | delay: down 5m multiplier 1.5 max 1h |
| 15 | summary: Elasticsearch cluster ${label:cluster_name} status |
| 16 | info: Elasticsearch cluster ${label:cluster_name} health status is red. |
| 17 | to: sysadmin |
| 18 | |
| 19 | # the idea of '-10m' is to handle yellow status after node restart, |
| 20 | # (usually) no action is required because Elasticsearch will automatically restore the green status. |
| 21 | template: elasticsearch_cluster_health_status_yellow |
| 22 | on: elasticsearch.cluster_health_status |
| 23 | class: Errors |
| 24 | type: SearchEngine |
| 25 | component: Elasticsearch |
| 26 | lookup: average -10m unaligned of yellow |
| 27 | every: 1m |
| 28 | units: status |
| 29 | warn: $this == 1 |
| 30 | delay: down 5m multiplier 1.5 max 1h |
| 31 | summary: Elasticsearch cluster ${label:cluster_name} status |
| 32 | info: Elasticsearch cluster ${label:cluster_name} health status is yellow. |
| 33 | to: sysadmin |
| 34 | |
| 35 | template: elasticsearch_node_index_health_red |
| 36 | on: elasticsearch.node_index_health |
| 37 | class: Errors |
| 38 | type: SearchEngine |
| 39 | component: Elasticsearch |
| 40 | lookup: average -5s unaligned of *ed |
| 41 | every: 10s |
| 42 | units: status |
| 43 | warn: $this == 1 |
| 44 | delay: down 5m multiplier 1.5 max 1h |
| 45 | summary: Elasticsearch cluster ${label:cluster_name} index ${label:index} status |
| 46 | info: Elasticsearch cluster ${label:cluster_name} index ${label:index} health status is red. |
| 47 | to: sysadmin |
| 48 | |
| 49 | # don't convert 'lookup' value to seconds in 'calc' due to UI showing seconds as hh:mm:ss (0 as now). |
| 50 | |
| 51 | template: elasticsearch_node_indices_search_time_query |
| 52 | on: elasticsearch.node_indices_search_time |
| 53 | class: Workload |
| 54 | type: SearchEngine |
| 55 | component: Elasticsearch |
| 56 | lookup: average -10m unaligned of query |
| 57 | every: 10s |
| 58 | units: milliseconds |
| 59 | warn: $this > (($status >= $WARNING) ? (20 * 1000) : (30 * 1000)) |
| 60 | delay: down 5m multiplier 1.5 max 1h |
| 61 | summary: Elasticsearch cluster ${label:cluster_name} node ${label:node_name} query performance |
| 62 | info: Elasticsearch cluster ${label:cluster_name} node ${label:node_name} search performance is degraded, queries run slowly. |
| 63 | to: sysadmin |
| 64 | |
| 65 | template: elasticsearch_node_indices_search_time_fetch |
| 66 | on: elasticsearch.node_indices_search_time |
| 67 | class: Workload |
| 68 | type: SearchEngine |
| 69 | component: Elasticsearch |
| 70 | lookup: average -10m unaligned of fetch |
| 71 | every: 10s |
| 72 | units: milliseconds |
| 73 | warn: $this > (($status >= $WARNING) ? (3 * 1000) : (5 * 1000)) |
| 74 | crit: $this > (($status == $CRITICAL) ? (5 * 1000) : (30 * 1000)) |
| 75 | delay: down 5m multiplier 1.5 max 1h |
| 76 | summary: Elasticsearch cluster ${label:cluster_name} node ${label:node_name} fetch performance |
| 77 | info: Elasticsearch cluster ${label:cluster_name} node ${label:node_name} search performance is degraded, fetches run slowly. |
| 78 | to: sysadmin |