apiVersion: v1
kind: ConfigMap
metadata:
  name: elastalert-rules
  labels:
    app: elastalert
    stack: efk
data:
  application-error.yaml: |
    name: Report Application Error
    type: any
    index: application.error-%Y.%m.%d
    use_strftime_index: True

    filter:
      - terms:
          environment: ["production", "staging"]

    query_delay:
      minutes: 1
    realert:
      minutes: 1
    query_key:
      - application_name
      - environment
      - message

    alert:
      - email
    email:
      - $SMTP_ELASTALERT_TO
    alert_subject: "[{0} 应用报错] {1}环境，{2}应用"
    alert_subject_args:
      - "@timestamp"
      - environment
      - application_name

  php-error.yaml: |
    name: Report PHP Error
    type: any
    index: php.error-%Y.%m.%d
    use_strftime_index: True

    filter:
      - terms:
          environment: ["production", "staging"]
      - term:
          level: "Fatal error"

    query_delay:
      minutes: 1
    realert:
      minutes: 1
    query_key:
        - message

    alert:
      - email
    email:
      - $SMTP_ELASTALERT_TO
    alert_subject: "[{0} PHP报错] {1}主机"
    alert_subject_args:
      - "@timestamp"
      - hostname
