1. It is already configured, and match is also displayed in debug, but alert is not sent. The configuration file is as follows:
rule configuration:
name: ossec_rule
type: any
index: logstash-ossec-*
filter:
- term:
type: "ossec"
alert:
- "post"
http_post_url: "http://.../"
config.yaml configuration:
rules_folder: ossec_rules
run_every:
seconds: 1
buffer_time:
seconds: 1
es_host: 127.0.0.1
es_port: 9200
writeback_index: elastalert_status
alert_time_limit:
days: 1
solution is really urgent, thank you all.