Elasticsearch Alerts

The following menu is Alerts. Here, Hayei displays the current set of alerts by metrics.

In one view, clients can see details about each alert, for example,  who will receive the email alert when an event is detected. Hayei divides the alerts by data source, environment, and logger. It allows the user to set different alerts based on predetermined conditions.

To set a new alert, Hayei provides details about each kind of alert. First, the user needs to choose the type of alert between Data Source, Environment, or Logger.

A Data Source is an ELK integration that centralized logs under one or multiple indexes (e.g., yul-3-flog-*). Hayei handles each index as an Environment. An Environment generates logs based on the applications running in the host under monitoring (e.g., controller001). In addition, each application becomes a Logger in Hayei (e.g., mariadb).

After selecting the alert type, the user would choose which data source, environment, or logger to use. Then, depending on the alert type, Hayei would show the conditions that trigger the alarm. Finally, the user must provide an email address or Slack channel where Hayei sends the notification.

The list of alerts shows in one view all the alerts by e-mail and by Slack.

For each alert, Hayei shows the history.

A single alert can trigger multiple notifications. For example, the below alert indicates that Hayei detects and labels a new log as Incident Type 91.  By default, the severity is Unknown. 

To set a Slack alert, the user has to configure access first. 

Hayei would redirect the user to the Slack Sign-in page to complete the setup.