[{"_1":2,"_161":-5,"_162":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_129":-5,"_130":11,"_131":21,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137,"_138":91,"_139":-7},"canonicalUrl","https://hub.docker.com/r/cadab/sear/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","cadab","reponame","sear","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":21,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2018-02-08T10:43:05.841333Z","description","Simple ElasticSearch Alerting by Redev","is_private","last_updated","2021-07-26T09:20:18.007666Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",306,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","## Simple ElasticSearch Alerting by Redev\n\nSear is a bare bones application to provide simple alerting for ElasticSearch. It simply queries your ES data, as defined in an Alert config, when the query hits are higher or lower than the specified threshold an action is performed.\n\n![Example Teams Alert](https://raw.githubusercontent.com/RedevLtd/Sear/master/TeamsAlert.PNG)\n\n## Installation\n\n### Docker\n\n\tdocker run -v /home/sear/alerts/:/app/Alerts -p 8080:8080 cadab/sear\n\n## Example Configuration\n\nBelow is an example Sear Alert config, the Query is sent to your ES server as define.\n\nIf the number of hits falls below 100 then the action will be triggered based on the escalation timespan.\n\nFor example a timespan of `0` would send the action immediately, a timespan of `60` would only send once the alert has been triggered for over an hour. This allows you to create different actions based on the severity and length of an issue.\n\nThe interval is set via a standard cron definition.\n\nFor most alerts you can define the 'SimpleQuery' object, this has properties for the search text of your query and the timespan to look back for. If this is defined then the `AdvancedQuery` will be ignored, you only need one defined unlike the example.\n\nThe `AdvancedQuery` allows you to define a more complex ElasticSearch query. In the example below both the simple and advanced queries would return the same results.\n\n\t{\n \"Name\": \"Test Alert\",\n \"Interval\": \"* * * * *\",\n \"Host\": \"http://localhost:9200\",\n \"Index\": \"logstash-*\",\n \"AdvancedQuery\": \"{\\\"query\\\":{\\\"bool\\\":{\\\"must\\\":[{\\\"query_string\\\":{\\\"query\\\":\\\"MessageObject.MetricType: \\\\\\\"SyncStats\\\\\\\"\\\",\\\"analyze_wildcard\\\":true,\\\"default_field\\\":\\\"*\\\"}},{\\\"query_string\\\":{\\\"query\\\":\\\"*\\\",\\\"analyze_wildcard\\\":true,\\\"default_field\\\":\\\"*\\\"}},{\\\"match_phrase\\\":{\\\"MessageObject.MetricType\\\":{\\\"query\\\":\\\"SyncStats\\\"}}},{\\\"range\\\":{\\\"@timestamp\\\":{\\\"gte\\\":\\\"now-30m\\\",\\\"lte\\\":\\\"now\\\"}}}],\\\"filter\\\":[],\\\"should\\\":[],\\\"must_not\\\":[]}}}\",\n \"SimpleQuery\": {\n \"SearchQuery\": \"MessageObject.MetricType: \\\\\\\"SyncStats\\\\\\\"\",\n \"TimeSpan\": \"now-30m\"\n },\n \"HitType\": \"Lower\",\n \"Hits\": 100,\n \"Actions\": [\n {\n \"$type\": \"SearAlertingServiceCore.Actions.SendGridEmailAction, SearAlertingServiceCore\",\n \"SendGridApiKey\": \"\",\n \"To\": \"info@redev.co.uk\",\n \"From\": \"info@redev.co.uk\",\n \"EscalationTimeSpan\": 0\n }, \n {\n \"$type\": \"SearAlertingServiceCore.Actions.SlackAction, SearAlertingServiceCore\",\n \"MessagePrefix\": \"<@here>\",\n \"SlackUrl\": \"https://hooks.slack.com/services/\",\n \"EscalationTimeSpan\": 0,\n \"Link\": \"http://linktoyourviz.co.uk\"\n }\n {\n \"$type\": \"SearAlertingServiceCore.Actions.SlackAction, SearAlertingServiceCore\",\n \"MessagePrefix\": \"<@everyone> Alert has been triggered for over an hour!\",\n \"SlackUrl\": \"https://hooks.slack.com/services/\",\n \"EscalationTimeSpan\": 60,\n \"Link\": \"http://linktoyourviz.co.uk\"\n }\n\n ], \n \"HasTriggered\": false,\n \"WhenTriggered\": null,\n \"AlertOnImproved\": false\n}\n\n### Actions\n\nMultiple actions can be defined for an alert. Currently Slack, Email (via SendGrid) and SMS (via AQL) actions are supported, below are example configs of each.\n\n`EscalationTimeSpan` This defines how many minutes SEAR will wait since the alert first triggered before firing this action. e.g. a value of `60` would only fire the action if the alert had been triggering continuously for over an hour. `0` would fire the action immediately.\n\n#### Slack\n\n {\n \"$type\": \"SearAlertingServiceCore.Actions.SlackAction, SearAlertingServiceCore\",\n \"MessagePrefix\": \"<@everyone>\",\n \"SlackUrl\": \"https://hooks.slack.com/services/\",\n \"EscalationTimeSpan\": 0,\n \"Link\": \"http://linktoyourviz.co.uk\"\n }\n\n#### Teams\n\n {\n \"$type\": \"SearAlertingServiceCore.Actions.TeamsAction, SearAlertingServiceCore\", \n \"TeamsUrl\": \"\",\n \"EscalationTimeSpan\": 0,\n \"Link\": \"http://linktoyourviz.co.uk\"\n }\n\n#### Email (SendGrid)\n\nMultiple `To` emails can be defined, seperated with a semi-colon\n\n {\n\t\t\"$type\": \"SearAlertingServiceCore.Actions.SendGridEmailAction, SearAlertingServiceCore\",\n\t\t\"SendGridApiKey\": \"\",\n\t\t\"To\": \"info@redev.co.uk;support@redev.co.uk\",\n\t\t\"From\": \"info@redev.co.uk\",\n\t\t\"EscalationTimeSpan\": 0\n }\n\n#### SMS (AQL)\n\nMultiple `Numbers` can be defined\n\n {\n \"$type\": \"SearAlertingServiceCore.Actions.AqlSmsAction, SearAlertingServiceCore\",\n \"AqlUrl\": \"https://api.aql.com/v2/sms/send\",\n \"AqlToken\": \"\",\n \"Numbers\": [ \"447123456789\", \"447987654321\" ],\n \"EscalationTimeSpan\": 0\n }\n\n### Todo\n\n- [x] Alert on resolved/improved\n- [x] Email Alert Action\n- [x] Web Dashboard\n- [x] Specific configs for alert actions\n- [x] Alert Escalation actions\n- [ ] Add/Remove/Modify alert rules while running\n- [ ] Spike trigger type\n- [ ] Prevent alert spam (multiple on/off trigger messages in short time window)\n- [ ] Better docs :)\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",554350737,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},"content_type","creator",708233,"full_size",79269560,"id",21960562,"images",[101],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},"architecture","amd64","digest","sha256:170b224a21755307db6501f2679726d2a52bc103912cafc58e23c5f8e9dcaa00","features","","last_pulled","2026-10-06T12:18:09.074498489Z","last_pushed","2021-07-26T09:20:18Z","os","linux","os_features","os_version","size","variant","2021-07-26T09:20:17.57387Z","last_updater","last_updater_username","media_type","latest","repository",3932964,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":142,"_149":150,"_136":159,"_160":11},{"_40":143,"_42":144,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":145,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":146,"_79":21,"_80":148,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":147},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_151":64,"_152":-5,"_153":-5,"_154":155},"count","next","previous","results",[156],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":157,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},[158],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},[],"canDeleteTags","actionData","errors"]

cadab/sear

Tags for cadab/sear