Riemann custom config

gistfile1.txt

; pardon syntax - clojure newb

; Custom subject
(def email
  (mailer
    {
      :from "[email protected]"
      :host "localhost"
      :subject (fn [events] (apply str "RIEMANN DETECTION: " (get-in (first events) [:host]) " TRIGGERED [" (get-in (first events) [:service]) " STATE]: " (get-in (first events) [:state])))
    }
  )
)

; rollup after 5 emails per hour
(def tell-ops (by :host (by :service (rollup 5 3600 (email "[email protected]")))))

; Some sample email stream alerts
(streams
  (by :host
  	(by :service
  		(where (service "IIS_RESPONSE")
  			(where
  				(and
  				  (not (state #"1.*"))
            (not (state #"2.*"))
            (not (state #"3.*"))
  					(not (state #"401"))
  					(not (state #"404"))
  					(not (and (state #"409") (or (host #"ci.*") (host #"dev.*") (host #"test.*"))))
  					(not (state "expired"))
  					(not (state #".*iis_response_code.*"))
  				) tell-ops
  			)
  		)
  		(where (service "LBSTATUS")
  			(where (state "ERROR") tell-ops)
  		)
  		(where (service "WIN_EVENT_VIEWER")
  			(by :win_event_viewer_server_name
  				(by :win_event_viewer_process_name
  					(where (state "ERROR") tell-ops)
  		)))
  	)
  )
)