Yaml监控规则编写示例

1、目前已实现的Trigger触发器

• ActionTrigger 行为动作匹配
• FieldTrigger 消息字段匹配
• CompareTrigger 数值匹配
• DatetimeTrigger 日期匹配
• StatsTrigger 考虑实现统计类触发器

2、Trigger触发器配置样例

• ActionTrigger 行为动作匹配

# 规则配置
EventID :
    title : 提现操作时调用浙商接口失败动作
    action : withdraw_cash
    trigger :
        -
            type : action
            value : call_zs_api_failed
            frequency : once
# 提现操作行为日志
{"timestamp":"2018-07-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.account", "action":"withdraw_cash", "unique_id":"200812348793345212"}
# 调用浙商接口失败行为日志
{"timestamp":"2018-07-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.account", "action":"call_zs_api_failed", "unique_id":"200812348793345212"}

• FieldTrigger 消息字段匹配

EventID :
    title : 二次展期行为日志
    action : extend
    filter :
         -
            type : field
            key : extended_times
            value : 2
# 消息格式
{"timestamp":"2018-07-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.xd", "action":"extend", "unique_id":"200812348793345212", "property":{"extended_times":2}}

• CompareTrigger 数值匹配

# 规则配置
EventID :
    title : 匹配投资金额大于账户余额
    trigger :
        -
            type : compare
            compare : gt
            from : finance_amout
            target : account_amout
# 消息格式
{"timestamp":"2018-07-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.account", "action":"callZsApi", "unique_id":"200812348793345212", "property":{"finance_amout":1000, "account_amout":900}}

• DatetimeTrigger 日期匹配

# 规则配置
EventID :
    title : 对项目prj_id=20180720224512345投资行为产生之后从当前0点开始计算15天后还未产生还款成功行为则触发预警，15天之内监控到还款成功行为则取消监控
    action : finance_success
    post_action : repayment_success
    filter :
        -
            type : field
            key : prj_id
            value : 20180720224512345
    trigger :
        -
            type : datetime
            compare : gt
            from : xxx # 默认当前时间
            target : xxx # 默认行为日志记录时间timestamp
            value : 15
            unit: day
            frequency : loop
            delay : 24
    collect :
        -
            type : action
            value : recharge,cancel_order,create_repay_plan
# 投资行为日志
{"timestamp":"2018-07-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.finance", "action":"finance_success", "unique_id":"200812348793345212", "property":{"prj_id":"20180720224512345"}}
# 还款行为日志
{"timestamp":"2018-09-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.repayment", "action":"repayment_success", "unique_id":"200812348793345212"}

3、运营指标监控分析

预警监控

• 还款计划超1分钟完成进行预警
• 还款超1分钟完成进行预警
• 签章处理超1H完成进行预警

通过埋点，由elk完成统计

• 还款计划统计指标，埋点举例

{"action":"create_repayment_plan", "prj_id":"20181234", "total_time":50}
{"action":"create_repayment_plan", "prj_id":"20182345", "total_time":70}
{"action":"create_repayment_plan", "prj_id":"20183456", "total_time":90}

• 投资统计指标

{"action":"finance", "prj_id":"20181234", "result":1}
{"action":"finance", "prj_id":"20185678", "result":0}

4、多环节监控预警需求配置举例

• 代扣异常监控：如果代扣请求在1小时内未代扣成功，则邮件提示1小时内未代扣成功的总笔数，以及明细信息（订单及错误原因）。
  及节假日短信预警，短信预警去掉账户余额不足的情况，只提示从代扣请求开始1小时内还未代扣成功的笔数。

EventID :
    title : 代扣异常监控
    action : daikou_request_action
    post_action : daikou_finish_action
    trigger :
        -
            type : datetime
            compare : gt
            value : 1
            unit : hour
    collect :
        -
            type : action
            value : daikou_failed_action
# 代扣请求开始行为日志
{"timestamp":"2018-07-25T00:26:15.000000+08:00", "channel":"xhh.point", "service":"xhh.xiaoe", "action":"daikou_request_action", "unique_id":"200812348793345212", "property":{"daikou_total":999}}
# 代扣成功完成后行为日志
{"timestamp":"2018-07-25T00:50:15.000000+08:00", "channel":"xhh.point", "service":"xhh.xiaoe", "action":"daikou_finish_action", "unique_id":"200812348793345212"}
# 每笔代扣失败后的行为日志
{"timestamp":"2018-07-25T00:50:15.000000+08:00", "channel":"xhh.point", "service":"xhh.xiaoe", "action":"daikou_failed_action", "unique_id":"200812348793345212", "property":{"order_id":123, "error_message":"请求超时"}}

• 财务完成线下充值未触发还款：财务完成了还款充值，但超过5分钟未调用还款系统，邮件预警，及节假日短信预警。

EventID :
    title : 财务完成线下充值未触发还款
    action : repayment_recharge
    post_action : call_repayment_action
    trigger :
        -
            type : datetime
            compare : gt
            value : 5
            unit : minute
# 还款充值行为日志
{"timestamp":"2018-07-25T00:50:15.000000+08:00", "channel":"xhh.point", "service":"xhh.xiaoe", "action":"repayment_recharge", "unique_id":"200812348793345212"}
# 调用还款系统行为日志
{"timestamp":"2018-07-25T00:50:15.000000+08:00", "channel":"xhh.point", "service":"xhh.xiaoe", "action":"call_repayment_action", "unique_id":"200812348793345212"}