elastalert
elastalert copied to clipboard
Accessing rules in subdirectories?
TL;DR: API doesn't seem to handle rule/template subdirectories, I can't tell from the documentation if this is intentional or not.
I have the following directory structure under my rules/
folder:
|- detection.yaml
`- testfolder/
`- testrule.yaml
Requesting /rules
from the API returns what you'd expect:
{"directories":["testfolder"],"rules":["detection"]}
The thing is, the API doesn't seem to be aware of testrule.yaml
, and doesn't allow me a way to interact with it or with testfolder
- which seems odd, because:
- The API is at least aware of directories inside the rules folder, and I'm not sure why it would expose their existence if they're not intended to be interacted with. (The documentation even specifically says "Returns a list of directories and rules that exist in the rulesPath (from the config) and are being run by the ElastAlert process.")
- The ElastAlert documentation alludes to a
scan_subdirectories
option, which defaults totrue
, and configures ElastAlert to recursively look for rules in therules
directory.
Various attempts I've made:
Request | Result |
---|---|
/rules |
{"directories":["testfolder"],"rules":["detection"]} |
/rules/detection |
[contents of detection.yaml] |
/rules/testfolder |
{"error":"ruleNotFound","message":"The requested rule with id: 'testfolder' couldn't be found.","statusCode":404} |
/rules/testfolder/testrule |
Cannot GET /rules/testfolder/testrule |
/rules/testrule |
{"error":"ruleNotFound","message":"The requested rule with id: 'testrule' couldn't be found.","statusCode":404} |
I have pretty limited understanding of Node.js so I can't really tell from the source if there's a syntax I should be using instead.