elastalert icon indicating copy to clipboard operation
elastalert copied to clipboard

Accessing rules in subdirectories?

Open jfcantu opened this issue 5 years ago • 0 comments

TL;DR: API doesn't seem to handle rule/template subdirectories, I can't tell from the documentation if this is intentional or not.


I have the following directory structure under my rules/ folder:

|- detection.yaml
`- testfolder/
   `- testrule.yaml

Requesting /rules from the API returns what you'd expect:

{"directories":["testfolder"],"rules":["detection"]}

The thing is, the API doesn't seem to be aware of testrule.yaml, and doesn't allow me a way to interact with it or with testfolder - which seems odd, because:

  • The API is at least aware of directories inside the rules folder, and I'm not sure why it would expose their existence if they're not intended to be interacted with. (The documentation even specifically says "Returns a list of directories and rules that exist in the rulesPath (from the config) and are being run by the ElastAlert process.")
  • The ElastAlert documentation alludes to a scan_subdirectories option, which defaults to true, and configures ElastAlert to recursively look for rules in the rules directory.

Various attempts I've made:

Request Result
/rules {"directories":["testfolder"],"rules":["detection"]}
/rules/detection [contents of detection.yaml]
/rules/testfolder {"error":"ruleNotFound","message":"The requested rule with id: 'testfolder' couldn't be found.","statusCode":404}
/rules/testfolder/testrule Cannot GET /rules/testfolder/testrule
/rules/testrule {"error":"ruleNotFound","message":"The requested rule with id: 'testrule' couldn't be found.","statusCode":404}

I have pretty limited understanding of Node.js so I can't really tell from the source if there's a syntax I should be using instead.

jfcantu avatar Oct 17 '19 22:10 jfcantu