#3271·elastalert

elastalert cannot find index app* in openshift

Author: BalighRezguiCreated Nov 15, 2022Updated Nov 30, 2024

Hello,

I configured an elastalert with elasticsearch on an openshift cluster when I configure an alert ruels for the infra-* index to capture a word it works but when I change the index in the ruels app-* it does not work. Apparently elastalert can see the infra index and is not seeing the app. any ideas ?

data: my-rules.yaml: | name: test type: frequency index: infra* (or app*) num_events: 1 timeframe: minutes: 10 filter: - term: message: BIP - query: query_string: query: "NETWORK"