Status of the elastalert project

[usp-npe]

Hi all. I wanted to ask if anyone can give an insight in the status if this (very useful) project. I see that there are more than 1k issues reported, and over hundred pull requests, but it seems the issues get not triaged that much and pull requests don't get integrated or are not ready/compatible anymore. Is Yelp still supporting this project?

Anybody knows anything about the "beta" branch which includes some features like multi threading (it has not seen changes since last August)?

Or is anybody aware of a fork which is more active than the original repo?

[Qmando]

Hi, sorry about the inactivity in this project, we are not currently doing any active development on it. All of the branches, including beta, should be ignored, and are likely already merged.

I do plan on doing a final round of bug fixes and cleanup before we officially end support, probably sometime this year.

[ulfsa]

Hello and thank you for the clarification.

What would you recommend as a viable actively maintained alternative to Elastalert?

[usp-npe]

@Qmando thank you for the clarification and your quick answer. Is there any other tool you can recommend with similar features? Or would you just go with the features the ELK stack now has to offer (e.g. machine learning, alerts etc).?

[nsano-rururu]

The following are notifications for alerts based on Elasticsearch data.

Watcher

https://www.elastic.co/guide/en/kibana/7.8/watcher-ui.html

Alerting and action settings in Kibana

Alerts and Actions
Managing Alerts
Alert details
Managing Connectors

Open Distro for Elasticsearch

Alerting

Grafana

Perform alerting on data in Elasticsearch with Grafana
https://grafana.com/docs/grafana/latest/alerting/
https://grafana.com/docs/grafana/latest/alerting/notifications/

[nsano-rururu]

@ulfsa

The following items are maintained.
Since it depends on ElastAlert, there is a problem of whether ElastAlert can fork ElastAlert to major version upgrades of Elasticsearch and Python.

ElastAlert Server

johnsusek/elastalert-server
forked from ServerCentral/elastalert-server
https://github.com/johnsusek/elastalert-server

Praeco

ElastAlert WebUI

johnsusek/praeco
https://github.com/johnsusek/praeco

ElastAlert Kibana Plugin

nsano-rururu/elastalert-kibana-plugin
forked from bitsensor/elastalert-kibana-plugin
https://github.com/nsano-rururu/elastalert-kibana-plugin

[ulfsa]

Dear Naoyuki,

Thank you for your response.

Regarding notification alternatives to ElastAlert, the Watcher UI requires a Gold or above licence https://www.elastic.co/subscriptions, as do Action type = email when using Kibana UI Alerts. In conclusion, it seems one can not stay away from paying a licence if trying to use a pure ELK notification infrastructure.

For our needs, ElastAlert is a perfect match. I will try to contribute. In particular, I would like to have a set-comparison type Rule available, to verify for example a set of defined services are all up and running within some set timeframe. Basically the Rule would compare if the contents of sorted service array A is equal to the contents of Elasticsearch index query result (distinct/unique) attribute X sorted array B.

[nsano-rururu]

@Qmando

Is there an option to take over the maintenance of this repository to another person?

[Qmando]

@nsano-rururu

We do plan on doing that. I can't tell you exactly when.

[nsano-rururu]

@Qmando

Thank you for your answer

[nsano-rururu]

@Qmando

"Packages on Ubuntu 14.x: python-pip python-dev libffi-dev libssl-dev" seems to be old information and needs to be corrected.
https://elastalert.readthedocs.io/en/latest/running_elastalert.html

[nsano-rururu]

@usp-npe

Main repositories maintained independently

Category	URL	memo
ElastAlert 2	jertel/elastalert2	Official Fork
ElastAlert	JasperJuergensen/elastalert	Based on ElastAlert 0.2.4 refactoring and function addition etc.
ElastAlert	BigDataBoutique/elastalert	Based on ElastAlert 0.2.4 Added support for crontrigger, must_not. etc.
ElastAlert	auto1-oss/elastalert	Based on ElastAlert 0.2.1. Added support for auto resolve alert, generate_kibana6_link. etc.
ElastAlert	sherifabdlnaby/elastalert tag v0.4.0	Based on ElastAlert 0.2.1 jinja2 . etc.
ElastAlert	jsonar/elastalert	Based on ElastAlert 0.1.35. Adds original functions, supports Python 3.8, supports elasticsearch-py version upgrade, etc.
elastalert-kibana-plugin	Karql/elastalert-kibana-plugin	Support for Kibana 7.10.0～7.14.0
elastalert-kibana-plugin	nsano-rururu/elastalert-kibana-plugin	Support for Kibana 6.8.1～6.8.12、7.5.1～7.9.3
ElastAlert2 Server	Karql/elastalert2-server
ElastAlertServer,Praeco,ElastAlert	ElastAlertServer Helm Chart Praeco Helm Chart	ElastAlert 0.2.1 + Bugfix ServerCentral/elastalert-server fork + Bugfix
ElastAlertServer	coandco/elastalert-bitsensor	bitsensor/elastalert fork ElastAlert 0.2.1 Python 3.8
ElastAlertServer	yigitbasalma/elastalert	bitsensor/elastalert fork Kubernetes support added. ElastAlert 0.2.4 Python 3.8
Praeco	abirsigron/praeco	Based on Praeco 1.3.1. Added time window range alerts
Praeco	mareksimunek/praeco	Based on Praeco 1.0.1. added support for cutomAlert Type

[nsano-rururu]

@Qmando

If support ends, I think it's okay to end.
I don't think anyone will get angry.
Everyone is in trouble without knowing which one.

[nsano-rururu]

@usp-npe

Or is anybody aware of a fork which is more active than the original repo?

jertel/elastalert alt repo

https://hub.docker.com/r/jertel/elastalert-docker
https://github.com/jertel/elastalert/tree/alt
ElastAlert 0.2.4 + Fixed after 0.2.4 release
+

• TheHive alerter: Allow severity and tlp to be set by rule
• Switch out abandoned blist lib for sortedcontainers lib・・・Supports Python 3.9
• Fix docker test
• Fix test_rule.py error
• Fix Stomp
• Fix LineNotify & Pagertree
• Sync requirements.txt and setup.py
• Fix initializing self.thread_data.alerts_sent for running elastalert
• Remove Stride integration
• Update Docs for Zabbix
• Fix SnsAlerter
• Kibana Discover app link 7.4/7.5/7.6/7.7/7.8/7.9/7.10 support
• Fix documents
• Remove hipchat & Fix loaders.py
• Adds --silence_qk_value option to elastalert
• Add Jinja2 Templating Option to Alert Text Formatting
• Fix example
• Add tzlocal<3.0
• Update running_elastalert.rst
• Add opsgenie_addr to docs
• Fix ruletypes.rst typo
• Remove Duplicate Key in Schema YAML
• Update alert types and Third Party Tools Info
• Fix Zabbix
• Fix Logging to elastalert_logger
• Fix for the mapping error reported
• Del the forgotten code of new_style_string_format
• Fix slack ssl verification
• Fix is_enabled not work with reload
• Docs/squadcast http alerting
• Add Discord Alerter
• Add support for custom_details in the PagerDuty alerter v2 module
• unsupported operand type(s) for +=: 'int' and 'NoneType'
• Enabling to embed images into email alerter
• Add Docs: Elasticsearch Security Privileges
• Add ca certs and ignore ssl to HTTP Post
• support for agg_type percentiles fixes
• fix a configuration options of docs
• fix attribute error is raised when query ran for future
• corrected spike aggregation support for avg,min,max

[hottwister]

Is @jertel has the most complete and updated fork ?

[nsano-rururu]

@hottwister

I haven't checked all Elast Alert forks so I'm not sure if it's the most complete and updated fork.
As you can see, it's part of the 157 pull request.

[mrfroggg]

People can follow on this discussion here to pitch in their opinions about an official fork and the process of it: jertel#77