mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-07 17:52:46 +01:00
influx upgrade
This commit is contained in:
21
salt/influxdb/templates/alarm_logstash_eps.json
Normal file
21
salt/influxdb/templates/alarm_logstash_eps.json
Normal file
@@ -0,0 +1,21 @@
|
||||
[{
|
||||
"apiVersion": "influxdata.com/v2alpha1",
|
||||
"kind": "CheckThreshold",
|
||||
"metadata": {
|
||||
"name": "alarm-logstash-eps"
|
||||
},
|
||||
"spec": {
|
||||
"every": "1m0s",
|
||||
"name": "Logstash EPS at 0",
|
||||
"query": "from(bucket: \"telegraf/so_short_term\")\n |\u003e range(start: v.timeRangeStart, stop: v.timeRangeStop)\n |\u003e filter(fn: (r) =\u003e r[\"_measurement\"] == \"logstash_events\")\n |\u003e filter(fn: (r) =\u003e r[\"_field\"] == \"in\")\n |\u003e aggregateWindow(every: 1m, fn: mean, createEmpty: false)\n |\u003e yield(name: \"mean\")",
|
||||
"status": "active",
|
||||
"statusMessageTemplate": "Check: ${ r._check_name } is: ${ r._level }",
|
||||
"thresholds": [
|
||||
{
|
||||
"level": "CRIT",
|
||||
"type": "lesser",
|
||||
"value": 1
|
||||
}
|
||||
]
|
||||
}
|
||||
}]
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user