#2711·elastalert

After a while of stopping elastalert and starting it, it alerts several times

Author: mtudisco49Created Mar 11, 2020Updated Aug 19, 2024

Hi, I'm using elasticsearch 7.2 and last version of elastalert. I'm monitoring database status i and index, and i have configured a frequency rule to alert when a database is closed:

name: dbstatus
type: frequency
index: orachecks*
num_events: 1
timeframe:
  hours: 1
realert:
  minutes: 0
query_key: db_at_host.keyword
filter:
- query:
    query_string:
      query: "dbstatus.db_status: CLOSED AND type2.keyword: dbstatus"
alert:
- "email"
email:
- "email@doemain"

It was working fine, but i shutdown a database stopped elastalert and the following day when i started elast alert i got about 200 mails with the alert.

Anyone cant help me to see if it can be changed?

thanks