From f79f7d5df32154387f54fd0754e257149b82046b Mon Sep 17 00:00:00 2001 From: Adrian Eib Date: Tue, 2 Mar 2021 22:00:15 +0100 Subject: [PATCH] use rule timeframe when scan_entire_timeframe is set --- elastalert/elastalert.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/elastalert/elastalert.py b/elastalert/elastalert.py index b078c86db..310f6af4f 100755 --- a/elastalert/elastalert.py +++ b/elastalert/elastalert.py @@ -743,7 +743,7 @@ def set_starttime(self, rule, endtime): # Query from the end of the last run, if it exists, otherwise a run_every sized window rule['starttime'] = rule.get('previous_endtime', endtime - self.run_every) else: - rule['starttime'] = rule.get('previous_endtime', endtime - rule['timeframe']) + rule['starttime'] = endtime - rule['timeframe'] def adjust_start_time_for_overlapping_agg_query(self, rule): if rule.get('aggregation_query_element'):