elastalert
elastalert copied to clipboard
Old aggregation time still used when rerunning with different time
Hi, I'm running elastalert from the command line with - /usr/bin/python -m elastalert.elastalert --config /tmp/elastalert_config_file --verbose
it runs one alert - which was supposed to aggregate notifications and notify once a day
name: "<<K8S_ENV>>: Bug!"
type: frequency
index: logstash-*
num_events: 1
timeframe:
days: 1
max_query_size: 50
run_every:
days: 1
doc_type: doc
filter:
- query:
query_string:
query: "message: \"Test Craft Core for role *\""
alert:
- "email"
email:
- ###
aggregation:
days: 1
smtp_host: "smtp.gmail.com"
smtp_port: ###
from_addr: ###
smtp_auth_file: ###
smtp_ssl: true
alert_text_type: alert_text_only
alert_text: "Number of hits: {}"
alert_text_args: [num_hits]
and I changed it to run once in five minutes:
name: "<<K8S_ENV>>: Bug!"
type: frequency
index: logstash-*
num_events: 1
timeframe:
minutes: 5
max_query_size: 50
run_every:
minutes: 5
doc_type: doc
filter:
- query:
query_string:
query: "message: \"Test Craft Core for role *\""
alert:
- "email"
email:
- ###
aggregation:
minutes: 5
smtp_host: "smtp.gmail.com"
smtp_port: ###
from_addr: ###
smtp_auth_file: ###
smtp_ssl: true
alert_text_type: alert_text_only
alert_text: "Number of hits: {}"
alert_text_args: [num_hits]
but when rerunning the command line I still get notified that the next notification will be in almost 24 hours, so the aggregation is not updated
/tmp/elastalert_rules # /usr/bin/python -m elastalert.elastalert --config /tmp/elastalert_config_file --verbose
INFO:elastalert:Starting up
INFO:elastalert:Queried rule <<K8S_ENV>>: Bug! from 2020-01-13 09:13 UTC to 2020-01-13 09:16 UTC: 0 / 0 hits
INFO:elastalert:Ran <<K8S_ENV>>: Bug! from 2020-01-13 09:13 UTC to 2020-01-13 09:16 UTC: 0 query hits (0 already seen), 0 matches, 0 alerts sent
INFO:elastalert:Sleeping for 29.973544 seconds
INFO:elastalert:Queried rule <<K8S_ENV>>: Bug! from 2020-01-13 09:13 UTC to 2020-01-13 09:17 UTC: 1 / 1 hits
**INFO:elastalert:Adding alert for <<K8S_ENV>>: Bug! to aggregation(id: BTUGnm8BSdVvK2DDcvAg, aggregation_key: None), next alert at 2020-01-14 08:30:20.189348+00:00**
The config file which was used:
rules_folder: RULES_PATH
run_every:
seconds: 30
buffer_time:
minutes: 15
es_host: ELK_SERVER
es_port: 9200
highlight=send_get_body_as#transport
writeback_index: elastalert_status
alert_time_limit:
days: 2
**Expected Behavior: ** Next alert to be in 5 minutes, messages should be aggregated I'd appreciate any kind of help, thanks in advance!