elastalert
elastalert copied to clipboard
run_every and buffer_time seem does not work properly
is_enabled: True rules_folder: bdfint_rules run_every: minutes: 3 buffer_time: minutes: 3 use_ssl: False verify_certs: False es_send_get_body_as: GET verify_certs: False writeback_index: elastalert_status alert_time_limit: minutes: 30
In my config.yaml,"run_every" is 3 minutes and "buffer_time" is 3 minutes too. I think this means query elasticsearch every 3 minutes and each time it will query the docs in es 3 minutes backwards . For example: at 1:00 pm,it will run first query for the docs in time range 00:57-01:00,and at 1:03,it will run second query for the docs in time range 01:00-01:03. and this also means in elastalert_status type,the gap between "starttime" and "endtime" will also be 3 minutes.
However,in elastalert_status index,the gap between "starttime" and "endtime" is not 3 minutes always,the gap may be 10 minutes or 15 minutes.