Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add realert_key feature #1004

Merged
merged 4 commits into from
Nov 11, 2022
Merged

Add realert_key feature #1004

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d123a4e
Add realert key to rule configuration
Goggin Nov 9, 2022
0881d1f
Update CHANGELOG
Goggin Nov 9, 2022
e104bb6
If running silence with query, use realert key
Goggin Nov 9, 2022
b0ddf9e
Correct changelog entry format
jertel Nov 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
- None

## New features
- None
- Add `realert_key` option to silence groups of alerts - [#1004](https://github.com/jertel/elastalert2/pull/1004) - @goggin

## Other changes
- Upgrade pylint 2.15.3 to 2.15.5, pytest 7.1.3 to 7.2.0, pytest-xdist 2.5.0 to 3.0.2, sphinx 5.2.3 to 5.3.0, tox 3.26.0 to 3.27.0 - [#988](https://github.com/jertel/elastalert2/pull/988) - @nsano-rururu
Expand Down
8 changes: 8 additions & 0 deletions docs/source/ruletypes.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,8 @@ Rule Configuration Cheat Sheet
+--------------------------------------------------------------+ |
| ``realert`` (time, default: 1 min) | |
+--------------------------------------------------------------+ |
| ``realert_key`` (string, defaults to the rule name) | |
+--------------------------------------------------------------+ |
| ``exponential_realert`` (time, no default) | |
+--------------------------------------------------------------+ |
| ``match_enhancements`` (list of strs, no default) | |
Expand Down Expand Up @@ -495,6 +497,12 @@ This is applied to the time the alert is sent, not to the time of the event. It
that if ElastAlert 2 is run over a large time period which triggers many matches, only the first alert will be sent by default. If you want
every alert, set realert to 0 minutes. (Optional, time, default 1 minute)

realert_key
^^^^^^^^^^^

``realert_key``: This option allows you to customize the key for ``realert``. The default is the rule name, but if you have multiple rules that
you would like to use the same key for you can set the ``realert_key`` to be the same in those rules. (Optional, string, default is the rule name)

exponential_realert
^^^^^^^^^^^^^^^^^^^

Expand Down
4 changes: 2 additions & 2 deletions elastalert/elastalert.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -880,7 +880,7 @@ def run_rule(self, rule, endtime, starttime=None):
# If realert is set, silence the rule for that duration
# Silence is cached by query_key, if it exists
# Default realert time is 0 seconds
silence_cache_key = rule['name']
silence_cache_key = rule['realert_key']
query_key_value = self.get_query_key_value(rule, match)
if query_key_value is not None:
silence_cache_key += '.' + query_key_value
Expand Down Expand Up @@ -1675,7 +1675,7 @@ def silence(self, silence_cache_key=None):
# With --rule, self.rules will only contain that specific rule
if not silence_cache_key:
if self.args.silence_qk_value:
silence_cache_key = self.rules[0]['name'] + "." + self.args.silence_qk_value
silence_cache_key = self.rules[0]['realert_key'] + "." + self.args.silence_qk_value
else:
silence_cache_key = self.rules[0]['name'] + "._silence"
Copy link
Owner

@jertel jertel Nov 9, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wondering if this line 1680, and line 888, should also use the new rule['realert_key'] instead of rule['name']. If you made that change it would let users run elastalert from the command line, with the silence args and still silence an entire group of alerts instead of only one alert. For backward compatibility, line 888 could still check for rule['name'] + "._silence" so that pre-upgrade silenced rules remain silenced after the upgrade, but also check for `rule['realert_key'] + "._silence". Thoughts?

I can see how this contribution could be useful to some folks. Thanks for submitting the PR!

Copy link
Contributor Author

@Goggin Goggin Nov 10, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't do it for that because they may just want to manually silence a specific rule. Maybe there needs to be an option for both ?

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, that's fine with me to leave it as-is. I'll leave this open through tomorrow for any others to review.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good to me. Thanks for your quick reply in anycase.


Expand Down
1 change: 1 addition & 0 deletions elastalert/loaders.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,6 +333,7 @@ def load_options(self, rule, conf, filename, args=None):
rule.setdefault(key, val)
rule.setdefault('name', os.path.splitext(filename)[0])
rule.setdefault('realert', datetime.timedelta(seconds=0))
rule.setdefault('realert_key', rule['name'])
rule.setdefault('aggregation', datetime.timedelta(seconds=0))
rule.setdefault('query_delay', datetime.timedelta(seconds=0))
rule.setdefault('timestamp_field', '@timestamp')
Expand Down
1 change: 1 addition & 0 deletions elastalert/schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,7 @@ properties:
- type: string
aggregation: *timeframe
realert: *timeframe
realert_key: {type: string}
exponential_realert: *timeframe

buffer_time: *timeframe
Expand Down
1 change: 1 addition & 0 deletions tests/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ def ea():
'include': ['@timestamp'],
'aggregation': datetime.timedelta(0),
'realert': datetime.timedelta(0),
'realert_key': 'anytest',
'processed_hits': {},
'timestamp_field': '@timestamp',
'match_enhancements': [],
Expand Down