import datetime import elasticsearch import pytz import requests import time today_tmp = datetime.datetime.today() today_final = str(today_tmp).replace("-", ".").split(" ")[0] utc_tz = pytz.timezone('UTC') now_tmp = datetime.datetime.now(tz=utc_tz) min_tmp = now_tmp - datetime.timedelta(minutes=40) now_tmp1 = str(now_tmp).split(" ")[0] + "T" now_tmp2 = str(now_tmp).split(" ")[1].split("+")[0] + "z" now_final = now_tmp1 + now_tmp2 min_tmp1 = str(min_tmp).split(" ")[0] + "T" min_tmp2 = str(min_tmp).split(" ")[1].split("+")[0] + "z" min_final = min_tmp1 + min_tmp2 search_index = "metricbeat-6.8.15-" + today_final search_body = { "query":{ "bool":{ "filter":[ { "exists": { "field": "elasticsearch.node.stats.jvm.gc.collectors.old.collection.ms" } }, { "range": { "@timestamp": { "gte": min_final, "lte": now_final } } } ] } }, "sort": { "@timestamp": { "order": "desc" }} } es = elasticsearch.Elasticsearch("xxxxx:xxxxx") while True: res = es.search(index=search_index, body=search_body) hits_num=len(res['hits']['hits']) if hits_num <= 0: #处理未收到metricbeat收集的信息时的情况else: recent_hits_node = res['hits']['hits'][0]["_source"]['elasticsearch']['node'] node_name = recent_hits_node['name'] recent_oldgc_time = recent_hits_node['stats']['jvm']['gc']['collectors']['old']['collection']['ms'] if recent_oldgc_time >= 5000: #处理超过阈值时的情况 time.sleep(60)
metricbeat的安装和使用参考这里:https://www.cnblogs.com/to-here/p/14653636.html