Large amount of emails

[ngms17]

I accidentally activated a rule that generated thousands of alerts. Elastalert is setup to send the alert thourgh email.

I´m getting hundreds os emails regarding this alerts, which happened hours ago and are still chached. Is there any way to tell Elastalert to ignore this cached emails and remove them?

[jertel]

Once ElastAlert 2 sends an email there is no "undo" process. It cannot perform any type of administration control the remote SMTP servers.

Did you disable the problematic rule that generated the alert emails?

[ngms17]

Yes, i already disabled it

[jertel]

If the SMTP server configured in ElastAlert 2's config file or rule file is a local SMTP server (within your org's network) you could ask the SMTP administrator to perform an email cleanup procedure. If you pointed ElastAlert 2 at a remote SMTP server in the cloud, such as Gmail, then you could ask your SMTP server administrator to auto-filter out and delete emails containing the specific email subject line for that rule.