After a while of stopping elastalert and starting it, it alerts several times
Author: mtudisco49Created Mar 11, 2020Updated Aug 19, 2024
Hi, I'm using elasticsearch 7.2 and last version of elastalert. I'm monitoring database status i and index, and i have configured a frequency rule to alert when a database is closed:
name: dbstatus
type: frequency
index: orachecks*
num_events: 1
timeframe:
hours: 1
realert:
minutes: 0
query_key: db_at_host.keyword
filter:
- query:
query_string:
query: "dbstatus.db_status: CLOSED AND type2.keyword: dbstatus"
alert:
- "email"
email:
- "email@doemain"It was working fine, but i shutdown a database stopped elastalert and the following day when i started elast alert i got about 200 mails with the alert.
Anyone cant help me to see if it can be changed?
thanks
Source: YelpArchive/elastalert