nodered-elasticsearch-50x-check.json

[
    {
        "id": "d1f664fb.d8fb38",
        "type": "tab",
        "label": "Recent 50x proxy entries"
    },
    {
        "id": "8b520419.7182e8",
        "type": "inject",
        "z": "d1f664fb.d8fb38",
        "name": "Check every 2 mins",
        "topic": "",
        "payload": "",
        "payloadType": "date",
        "repeat": "120",
        "crontab": "",
        "once": false,
        "x": 190.8958282470703,
        "y": 140,
        "wires": [
            [
                "94233a9c.8a3fb8"
            ]
        ]
    },
    {
        "id": "a5b764ca.152538",
        "type": "http request",
        "z": "d1f664fb.d8fb38",
        "name": "Fetch stats from ElasticSearch",
        "method": "POST",
        "ret": "obj",
        "url": "http://elasticsearch:9200/proxylogs/_search",
        "tls": "",
        "x": 331.89581298828125,
        "y": 330,
        "wires": [
            [
                "994fadc7.5f3ed"
            ]
        ]
    },
    {
        "id": "e2e78514.99ab48",
        "type": "template",
        "z": "d1f664fb.d8fb38",
        "name": "Get 50x erros in last 2 mins",
        "field": "payload",
        "fieldType": "msg",
        "format": "json",
        "syntax": "mustache",
        "template": "{\n  \"query\": {\n    \"bool\": {\n      \"must\": {\n        \"range\": {\n          \"status\": {\n            \"gte\": 500,\n            \"lte\": 599\n          }\n        }\n      },\n      \"must_not\": {\n        \"term\": {\n          \"vhost\": \"www.foxy.co.uk\"\n        }\n      },\n      \"filter\": {\n        \"range\": {\n          \"time\": {\n            \"gte\": \"now-2m/m\",\n            \"lte\": \"now/m\"\n          }\n        }\n      }\n    }\n  }\n}\n",
        "output": "json",
        "x": 287.8958282470703,
        "y": 270,
        "wires": [
            [
                "a5b764ca.152538"
            ]
        ]
    },
    {
        "id": "cde7fd95.344a9",
        "type": "template",
        "z": "d1f664fb.d8fb38",
        "name": "Report on hits",
        "field": "payload",
        "fieldType": "msg",
        "format": "handlebars",
        "syntax": "mustache",
        "template": "Found {{{ payload.hits.total }}} HTTP proxy errors in last 2 minutes. See [Kibana](https://kibana.agentdesign.co.uk/) for more info.\n\n{{#payload.hits.hits}}({{{ _source.status }}}) [{{{ _source.vhost }}}] {{{ _source.path }}} ({{{ _source.x-forward-for }}})\n{{/payload.hits.hits}}",
        "output": "str",
        "x": 355.89581298828125,
        "y": 451,
        "wires": [
            [
                "5b9a3950.9a8a08"
            ]
        ]
    },
    {
        "id": "994fadc7.5f3ed",
        "type": "switch",
        "z": "d1f664fb.d8fb38",
        "name": "Check for results",
        "property": "payload.hits.total",
        "propertyType": "msg",
        "rules": [
            {
                "t": "gt",
                "v": "0",
                "vt": "str"
            }
        ],
        "checkall": "true",
        "outputs": 1,
        "x": 329.89581298828125,
        "y": 392,
        "wires": [
            [
                "cde7fd95.344a9"
            ]
        ]
    },
    {
        "id": "33e93d18.6ca432",
        "type": "comment",
        "z": "d1f664fb.d8fb38",
        "name": "Checks for recent 50x proxy log entries",
        "info": "",
        "x": 220.8958282470703,
        "y": 78,
        "wires": []
    },
    {
        "id": "94233a9c.8a3fb8",
        "type": "change",
        "z": "d1f664fb.d8fb38",
        "name": "Set Content Type",
        "rules": [
            {
                "t": "set",
                "p": "headers",
                "pt": "msg",
                "to": "{\"Content-type\":\"application/json\"}",
                "tot": "json"
            }
        ],
        "action": "",
        "property": "",
        "from": "",
        "to": "",
        "reg": false,
        "x": 234,
        "y": 202,
        "wires": [
            [
                "e2e78514.99ab48"
            ]
        ]
    },
    {
        "id": "b71f8682.0f9108",
        "type": "http request",
        "z": "d1f664fb.d8fb38",
        "name": "#web-proxy-alerts",
        "method": "POST",
        "ret": "txt",
        "url": "https://discordapp.com/api/webhooks/444022624738412345/TEvpOVezMAraW6OZeelazGaAuTTaHFA1tHavC5MXgOb1ok4Dxc7H4GotYouSWkxGOjhM",
        "tls": "",
        "x": 435,
        "y": 573,
        "wires": [
            [
                "76eda284.5a595c"
            ]
        ]
    },
    {
        "id": "5b9a3950.9a8a08",
        "type": "template",
        "z": "d1f664fb.d8fb38",
        "name": "Format for Discord",
        "field": "payload",
        "fieldType": "msg",
        "format": "json",
        "syntax": "mustache",
        "template": "{\n  \"content\": \"{{{payload}}}\"\n}",
        "output": "json",
        "x": 393,
        "y": 510,
        "wires": [
            [
                "b71f8682.0f9108"
            ]
        ]
    },
    {
        "id": "76eda284.5a595c",
        "type": "debug",
        "z": "d1f664fb.d8fb38",
        "name": "",
        "active": false,
        "console": "false",
        "complete": "false",
        "x": 639,
        "y": 569,
        "wires": []
    }
]