Elastalert Spike 配置说明2

请先看上一篇《Elastalert Spike 配置说明》

top_count_keys: ["ip","loginname"]

这个配置的意思是，按照count顺序把前5（默认）个ip字段和loginname加到邮件里。下面就是邮件报警的内容格式：

tanxiaolongspiketestAn abnormal number (2045) of events occurred around 2016-08-24 20:48 CST.Preceding that time, there were only 0 events within 0:02:00ip.raw:220.180.37.169: 21114.96.212.53: 20114.96.223.71: 1760.168.62.2: 16220.180.32.225: 15loginname.raw:unknown: 750%{[data][4]}: 1913980365780: 613514081319: 6

如果你想控制个数的话，可以通过

top_count_number

来进行控制。