How can I check if my server is alive with metricbeat, Is it possible?

Question

I've been using elasticsearch, metricbeat and elastalert to watch my server. I have nginx intalled on it that is been used as a reverse proxy and I need to send an to it if nginx drop or return some error, I have already some alerts configured but how can I make a rule to send alert to nginx when it drop or return some error. Thank a lot

Answer 1

Metricbeat is just for data about the system resources usage. What you need is installing filebeat and activating the nginx module. Then you can use the rule type any of elastalert and filter by fileset.module: nginx and fileset.name: error:

name: your rule name
index: filebeat-*
type: any
filter:
- term:
    fileset.module: "nginx"
- term:
    fileset.name: "error"
alert:
- "slack"
... # your slack config stuff
realert:
  minutes: 1