These are chat archives for Yelp/elastalert
Hi, I am facing delay problem in alerts received
Below is the alert I got.
Alert Sent 19:40
eventLogTime: 2016-04-05T16:25:00.575Z this is the field in Kibana/ES which is nothing but the time when event was created in logfile, not in ES>
At least 1 events occurred between 2016-04-05 19:10 EEST and 2016-04-05 19:25 EEST (timeframe)
Assuming there is time difference of 3 hours, the alert is delayed by 15 min.
Also it looks like all alerts are done during the end time of the time range, so the delay might actually be 30 min
All infrastructure is in Finnish timezone.
Problems: 1) Alert is sent 15 mins late. It was expected on 19.25. why?
2) Alert is sent at the end of timeframe. is it expected behaviour?
I have below configurtions in config.yaml
run_every: minutes: 15 buffer_time: minutes: 15 buffer_time: minutes: 15
type: frequency timeframe: minutes: 15 num_events: 1
Please help me how to overcome above 2 problems?
alert_text, and you can include fields from every document, but that becomes a big json blob
run_every: minutes: 15so of course it's gonna take 15 minutes.
timeframeis completely meaningless when num_events is 1.
type: anyexists, basically equivalent to a rule with frequency and num_events==1, but more efficient. Anyway just change
run_everyto 1 minute or something and that will solve your problems
filter: - query: query_string: query: "@message:\"ended with exit code 1\"" query_key: "@source" use_terms_query: true doc_type: "Task [./populateS3.js]" attach_related: true
use_terms_queryif you can get away with it. I don't think attach_related works with that anyway
use_terms_query, you can add
top_count_keys: [fieldX, fieldY]instead