elastalert cannot find index app* in openshift
Author: BalighRezguiCreated Nov 15, 2022Updated Nov 30, 2024
Hello,
I configured an elastalert with elasticsearch on an openshift cluster when I configure an alert ruels for the infra-* index to capture a word it works but when I change the index in the ruels app-* it does not work. Apparently elastalert can see the infra index and is not seeing the app. any ideas ?
data: my-rules.yaml: | name: test type: frequency index: infra* (or app*) num_events: 1 timeframe: minutes: 10 filter: - term: message: BIP - query: query_string: query: "NETWORK"
Source: YelpArchive/elastalert