Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
94 commits
Select commit Hold shift + click to select a range
fbce0fb
agg_type percentiles fixes 2713
Apr 21, 2020
b9963d9
Adjusting elastalert/ruletypes.py so that the functions 'append' and …
gminog-opap Apr 24, 2020
50bcd94
Adjusting elastalert/ruletypes.py so that the functions 'append' and …
gminog-opap Apr 24, 2020
2682074
fix aggregate_id search syntax
May 29, 2020
b267617
fix aggregate_id test
May 29, 2020
876d0e0
add quotes for search terms in tests
Jun 1, 2020
6b7caa4
removing quotes for search terms in tests
Jun 1, 2020
f98a940
fixed CI error
Jun 1, 2020
a107491
fix attribute error is raised when query ran for future
Swapnil811 Jun 23, 2020
62924c4
Add support for custom_details in the PagerDuty alerter v2 module
Oct 1, 2020
a9f0d1d
Fix for the mapping error reported in #2899.
Oct 28, 2020
c2a0151
fix(docs): corrects common typos in project README
plan-do-break-fix Apr 26, 2021
06880b0
Fix UnicodeEncodeError in PagerDutyAlerter
katkasian May 3, 2021
1143af1
Fix travis-ci job error
nsano-rururu Sep 23, 2021
75d670a
Fix docker test
nsano-rururu Sep 23, 2021
b795543
Fix test_rule.py
nsano-rururu Sep 23, 2021
455604a
Fix Stomp
nsano-rururu Sep 23, 2021
2a6f846
Fix PagerTree
nsano-rururu Sep 23, 2021
db30b9c
Fix LineNotify
nsano-rururu Sep 23, 2021
27f6800
Update Docs for SNS
nsano-rururu Sep 23, 2021
a1dfc45
Fix Zabbix(Docs & schema.yaml)
nsano-rururu Sep 23, 2021
c7e5f4e
Add tzlocal<3.0
nsano-rururu Sep 23, 2021
55ff06f
Change Library blist to sortedcontainers
nsano-rururu Sep 23, 2021
e1e0b43
Remove Duplicate Key in Schema YAML
nsano-rururu Sep 23, 2021
f2e955b
Typo in example_rules/ssh.yaml
nsano-rururu Sep 23, 2021
28d36ce
fix ruletypes.rst typo
nsano-rururu Sep 23, 2021
d986d8b
Fixed the logging property in config.yaml.example
nsano-rururu Sep 23, 2021
be95b4c
add opsgenie_addr to docs
nsano-rururu Sep 23, 2021
bacef7d
added squadcast to README
nsano-rururu Sep 23, 2021
67e63ff
Remove duplicate property in example config file
nsano-rururu Sep 23, 2021
92ccda9
Remove new_style_string_format
nsano-rururu Sep 23, 2021
fc5afa6
Sync requirements.txt and setup.py
nsano-rururu Sep 23, 2021
16b74fe
remove alerta_new_style_string_format
nsano-rururu Sep 23, 2021
203ff79
Fix initializing self.thread_data.alerts_sent for running elastalert-…
nsano-rururu Sep 23, 2021
abce867
TheHive alerter: Allow severity and tlp to be set by rule
nsano-rururu Sep 23, 2021
579bac5
Fix opsgenie_default_receipients to docs
nsano-rururu Sep 23, 2021
7962a2e
added docs opsgenie_proxy
nsano-rururu Sep 23, 2021
22fc5b1
added docs pagertree_proxy
nsano-rururu Sep 23, 2021
f06f86f
added docs telegram_proxy_login/pass
nsano-rururu Sep 23, 2021
5eaf58b
added docs slack_ca_certs
nsano-rururu Sep 23, 2021
9ae36a4
added docs slack_ignore_ssl_errors
nsano-rururu Sep 23, 2021
9084fd4
Fix opsgenie/zabbix/stomp for docs
nsano-rururu Sep 23, 2021
6347027
added docs alerta_api_skip_ssl
nsano-rururu Sep 23, 2021
042cba9
added docs hive_verify
nsano-rururu Sep 23, 2021
9b3861e
fix docs slack_timeout
nsano-rururu Sep 23, 2021
bee23c4
added docs jira_assignee
nsano-rururu Sep 23, 2021
b30d228
Fix for the mapping error reported
nsano-rururu Sep 23, 2021
effce13
Update docs
nsano-rururu Sep 23, 2021
7fde8af
Kibana Discover app link 7.4-7.15 support
nsano-rururu Sep 23, 2021
e0c88e7
Remove hipchat integration
nsano-rururu Sep 24, 2021
fc4559f
Remove Stride integration
nsano-rururu Sep 24, 2021
8675923
Fix slack ssl verification
nsano-rururu Sep 24, 2021
3e4b804
change mock to build in unittest.mock
nsano-rururu Sep 24, 2021
d48d3e3
Fix Logging to elastalert_logger
nsano-rururu Sep 24, 2021
12e0c74
apscheduler>=3.3.0,<4.0
nsano-rururu Sep 24, 2021
596e017
Fix is_enabled not work with reload
nsano-rururu Sep 24, 2021
00ed985
Bugfix and better error handling on zabbix alerter
nsano-rururu Sep 24, 2021
227410d
Revert travis-ci job error
nsano-rururu Sep 24, 2021
d1ab0ba
Update Pytest
nsano-rururu Sep 24, 2021
308777b
Merge pull request #1 from moix/master
nsano-rururu Sep 26, 2021
05992be
Merge pull request #2 from gminog/master
nsano-rururu Sep 26, 2021
01c7300
Merge pull request #3 from Swapnil811/bug_in_elastalert
nsano-rururu Sep 26, 2021
71da71f
Merge pull request #4 from skillz/chore-fix-aggregate-id-search-syntax
nsano-rururu Sep 26, 2021
38846ce
Revert Add tzlocal<3.0
nsano-rururu Sep 27, 2021
72ae2c7
remove configparser
nsano-rururu Sep 28, 2021
1abdef6
Merge pull request #5 from Zentrust/master
nsano-rururu Oct 2, 2021
b547545
Add ca certs and ignore ssl to HTTP Post
nsano-rururu Oct 3, 2021
0a09e36
Add Slack Alerts Footer
nsano-rururu Oct 3, 2021
c7d1d77
Add Support for Twilio Copilot
nsano-rururu Oct 3, 2021
877640a
add discord alerter
nsano-rururu Oct 3, 2021
abc5e1c
Add support for RocketChat
nsano-rururu Oct 3, 2021
cd27d98
Add alert handler to create Datadog Events
nsano-rururu Oct 3, 2021
c805619
Added Support Alertmanager
nsano-rururu Oct 25, 2021
ba39766
Update coverage, pylint, pytest, tox, sphinx
nsano-rururu Oct 25, 2021
c4a4b8e
Merge pull request #6 from katkasian/fix-pagerduty-encoding-issue
nsano-rururu Oct 26, 2021
efa6457
Merge pull request #7 from plan-do-break-fix/Typo-corrections
nsano-rururu Oct 26, 2021
34599e6
Update Dockerfile-test
nsano-rururu Oct 29, 2021
2f3018d
Merge branch 'elastalert025' of https://github.com/nsano-rururu/elast…
nsano-rururu Oct 29, 2021
561bfbb
pin tzlocal==2.1
nsano-rururu Nov 15, 2021
59593c7
sphinx 4.3.0
nsano-rururu Nov 16, 2021
e78432b
sphinx 4.3.1
nsano-rururu Dec 14, 2021
15d327f
python 3.10 support
nsano-rururu Dec 25, 2021
8a27c88
Merge branch 'elastalert025' of https://github.com/nsano-rururu/elast…
nsano-rururu Dec 25, 2021
ec5abd8
fix
nsano-rururu Dec 25, 2021
663b652
Kibana Discover support kibana 7.16
nsano-rururu Dec 25, 2021
6f6f301
Merge pull request #8 from drboone/fix2899
nsano-rururu Jan 5, 2022
442ab2f
Setting size to 0 avoids executing the fetch phase of the search maki…
nsano-rururu Jan 5, 2022
63325e4
Update setup.py
nsano-rururu Jan 5, 2022
2cb0ec4
tox 3.24.5 and pylint 2.12.2
nsano-rururu Jan 12, 2022
e75ee30
sphinx 4.3.2 to 4.4.0
nsano-rururu Jan 19, 2022
63a7d66
Added exotel_message_body to schema.yaml
nsano-rururu Jan 31, 2022
5d1e443
Kibana Discover support kibana 7.17
nsano-rururu Feb 4, 2022
9d0ca69
Merge branch 'elastalert025' of https://github.com/nsano-rururu/elast…
nsano-rururu Feb 4, 2022
7444552
Pytest 6.2.5 to 7.0.0
nsano-rururu Feb 5, 2022
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions Dockerfile-test
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
FROM ubuntu:latest
FROM ubuntu:21.10

RUN apt-get update && apt-get upgrade -y
RUN apt-get -y install build-essential python3.6 python3.6-dev python3-pip libssl-dev git
RUN apt update && apt upgrade -y
RUN apt install software-properties-common -y
RUN add-apt-repository ppa:deadsnakes/ppa
RUN apt -y install build-essential python3.10 python3.10-dev python3-pip libssl-dev git

WORKDIR /home/elastalert

Expand Down
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ test-elasticsearch:

test-docker:
docker-compose --project-name elastalert build tox
docker-compose --project-name elastalert run tox
docker-compose --project-name elastalert run --rm tox

clean:
make -C docs clean
Expand Down
44 changes: 27 additions & 17 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,23 +39,33 @@ Several rule types with common monitoring paradigms are included with ElastAlert

Currently, we have built-in support for the following alert types:

- Alerta
- Alertmanager
- Amazon Simple Notification Service (AWS SNS)
- Command
- Datadog
- Debug
- Discord
- Email
- JIRA
- Exotel
- Gitter
- Google Chat
- HTTP POST
- Jira
- Line Notify
- Mattermost
- Microsoft Teams
- OpsGenie
- Commands
- HipChat
- MS Teams
- Slack
- Telegram
- GoogleChat
- AWS SNS
- VictorOps
- Rocket.Chat
- PagerDuty
- PagerTree
- Exotel
- ServiceNow
- Slack
- Splunk On-Call (Formerly VictorOps)
- Stomp
- Telegram
- TheHive
- Twilio
- Gitter
- Line Notify
- Zabbix

Additional rule types and alerts can be easily imported or written.
Expand Down Expand Up @@ -115,13 +125,13 @@ A [Dockerized version](https://github.com/bitsensor/elastalert) of ElastAlert in

```bash
git clone https://github.com/bitsensor/elastalert.git; cd elastalert
docker run -d -p 3030:3030 \
docker run -d -p 3030:3030 -p 3333:3333 \
-v `pwd`/config/elastalert.yaml:/opt/elastalert/config.yaml \
-v `pwd`/config/config.json:/opt/elastalert-server/config/config.json \
-v `pwd`/rules:/opt/elastalert/rules \
-v `pwd`/rule_templates:/opt/elastalert/rule_templates \
--net="host" \
--name elastalert bitsensor/elastalert:latest
--name elastalert bitsensor/elastalert:3.0.0-beta.1
```

## Documentation
Expand Down Expand Up @@ -150,7 +160,7 @@ Examples of different types of rules can be found in example_rules/.
increases by a given factor. This example will send an email alert when there are 3 times more events matching a filter occurring within the
last 2 hours than the number of events in the previous 2 hours.

- ``example_frequency.yaml`` is an example of the "frequency" rule type, which will alert when there are a given number of events occuring
- ``example_frequency.yaml`` is an example of the "frequency" rule type, which will alert when there are a given number of events occurring
within a time period. This example will send an email when 50 documents matching a given filter occur within a 4 hour timeframe.

- ``example_change.yaml`` is an example of the "change" rule type, which will alert when a certain field in two documents changes. In this example,
Expand Down Expand Up @@ -267,7 +277,7 @@ status:

### How can I make the alert come at a certain time?

The ``aggregation`` feature will take every alert that has occured over a period of time and send them together in one alert. You can use cron style syntax to send all alerts that have occured since the last once by using
The ``aggregation`` feature will take every alert that has occurred over a period of time and send them together in one alert. You can use cron style syntax to send all alerts that have occurred since the last once by using

```
aggregation:
Expand All @@ -290,7 +300,7 @@ buffer_time:
minutes: 5
```

By default, ElastAlert will download every document in full before processing them. Instead, you can have ElastAlert simply get a count of the number of documents that have occured in between each query. To do this, set ``use_count_query: true``. This cannot be used if you use ``query_key``, because ElastAlert will not know the contents of each documents, just the total number of them. This also reduces the precision of alerts, because all events that occur between each query will be rounded to a single timestamp.
By default, ElastAlert will download every document in full before processing them. Instead, you can have ElastAlert simply get a count of the number of documents that have occurred in between each query. To do this, set ``use_count_query: true``. This cannot be used if you use ``query_key``, because ElastAlert will not know the contents of each documents, just the total number of them. This also reduces the precision of alerts, because all events that occur between each query will be rounded to a single timestamp.

If you are using ``query_key`` (a single key, not multiple keys) you can use ``use_terms_query``. This will make ElastAlert perform a terms aggregation to get the counts for each value of a certain field. Both ``use_terms_query`` and ``use_count_query`` also require ``doc_type`` to be set to the ``_type`` of the documents. They may not be compatible with all rule types.

Expand Down
61 changes: 30 additions & 31 deletions config.yaml.example
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ es_port: 9200

# Use SSL authentication with client certificates client_cert must be
# a pem file containing both cert and key for client
#verify_certs: True
#ca_certs: /path/to/cacert.pem
#client_cert: /path/to/client_cert.pem
#client_key: /path/to/client_key.key
Expand Down Expand Up @@ -78,38 +77,38 @@ alert_time_limit:
# logline:
# format: '%(asctime)s %(levelname)+8s %(name)+20s %(message)s'
#
# handlers:
# console:
# class: logging.StreamHandler
# formatter: logline
# level: DEBUG
# stream: ext://sys.stderr
# handlers:
# console:
# class: logging.StreamHandler
# formatter: logline
# level: DEBUG
# stream: ext://sys.stderr
#
# file:
# class : logging.FileHandler
# formatter: logline
# level: DEBUG
# filename: elastalert.log
# file:
# class : logging.FileHandler
# formatter: logline
# level: DEBUG
# filename: elastalert.log
#
# loggers:
# elastalert:
# level: WARN
# handlers: []
# propagate: true
# loggers:
# elastalert:
# level: WARN
# handlers: []
# propagate: true
#
# elasticsearch:
# level: WARN
# handlers: []
# propagate: true
# elasticsearch:
# level: WARN
# handlers: []
# propagate: true
#
# elasticsearch.trace:
# level: WARN
# handlers: []
# propagate: true
# elasticsearch.trace:
# level: WARN
# handlers: []
# propagate: true
#
# '': # root logger
# level: WARN
# handlers:
# - console
# - file
# propagate: false
# '': # root logger
# level: WARN
# handlers:
# - console
# - file
# propagate: false
28 changes: 22 additions & 6 deletions docs/source/elastalert.rst
Original file line number Diff line number Diff line change
Expand Up @@ -31,18 +31,34 @@ Several rule types with common monitoring paradigms are included with ElastAlert

Currently, we have support built in for these alert types:

- Alerta
- Alertmanager
- Amazon Simple Notification Service (AWS SNS)
- Command
- Datadog
- Debug
- Discord
- Email
- JIRA
- Exotel
- Gitter
- Google Chat
- HTTP POST
- Jira
- Line Notify
- Mattermost
- Microsoft Teams
- OpsGenie
- SNS
- HipChat
- PagerDuty
- PagerTree
- Rocket.Chat
- ServiceNow
- Slack
- Telegram
- GoogleChat
- Debug
- Splunk On-Call (Formerly VictorOps)
- Stomp
- Telegram
- TheHive
- Twilio
- Zabbix

Additional rule types and alerts can be easily imported or written. (See :ref:`Writing rule types <writingrules>` and :ref:`Writing alerts <writingalerts>`)

Expand Down
Loading