#1358·elastalert

Combining multiple alerts in Elastalert

Author: ajaybhatnagarCreated Sep 26, 2017Updated Nov 21, 2024

I have following questions on using Elastalert.

  1. How can I combine multiple alert types in one rule. For example I have a working metric_aggregation type rule with email alert notifications only. In addition to this email alert, I also want to execute a command to send the same alert to a dashboard being monitored via a scripted command . For example to execute bash command file on the server running elastalert, and be able to pass as argument to script some of the info from alert like alert_text . Is it possible to do in one rule or one has to run multiple rules separately ?

  2. If an alert has been generated, how one should determine if the alert condition has cleared after the last alert ? Is some data recorded in alert index file created in Elasticsearch ?

  3. If I have a cluster of servers and connecting them thru a proxy or loadbalancer, hostname contained in the alerts is that of load balancing or proxy node (not of the actual node hostname which caused alert). Any way to override/replace proxy / loadbalancing node with the actual host/node name which was generated the alert.

  4. What is the best way to manage alerts for multiple hosts ( say 100s of servers) from the same monitoring node running elastalert? For example, should the rules be kept in separate directories one for each host or one directory and rule file name identified by respective hostname or some some other mechanism i.e. configuration files ? Elasticsearch indices to be searched for alerts are created per host to be monitored. Any sizing consideration/ guidelines for such a setup ?

Thanks Ajay