The effect of run_every and buffer_time are not consistent

[raymanound]

The run_every and buffer_time can be configured in the global config and each rule individually. I assume the rule settings will always take precedence to override the global config setting. However, they take precedence differently in different places in elastalert.py. For example,

elastalert2/elastalert/elastalert.py

Line 739 in f55421b

rule['starttime'] = rule.get('previous_endtime', endtime - self.run_every)

elastalert2/elastalert/elastalert.py

Line 748 in f55421b

rule['starttime'] = rule['starttime'] - (rule['buffer_time'] - rule['run_every'])

elastalert2/elastalert/elastalert.py

Line 599 in f55421b

buffer_time = rule.get('buffer_time', self.buffer_time)

I think we can set the rule['run_every'] and rule['buffer_time'] to have the default value from the global config at the first place and make the rest of the codes always reference rule instead of self to make it consistent. This can also benefit other modules that have a rule context, like Enhancements.

[jertel]

I believe you are correct with respect to run_every but I don't see where buffer_time is also affected by this problem. It looks like all references to buffer_time already use the rule's value, but can fallback to the global value if the rule hasn't defined it. If you're suggesting only that the logic could be changed to not use the buffer_time fallback logic throughout the code and instead only do that during the rule init phase then I would agree that is a better approach.

There's also a known issue with rules not defaulting to a realert value defined at the global config level, and instead each requires its own explicit realert setting. So it would be nice to see both vars cleaned up to behave consistently.

If you're up for submitting a PR the contributing guidelines are documented here in the CONTRIBUTING.md file.

[raymanound]

Thanks for conforming. I will take a look at this.