@bitsensor/elastalert

Docker installation

Bash

docker run -d -p 3030:3030 \
    -v `pwd`/config/elastalert.yaml:/opt/elastalert/config.yaml \
    -v `pwd`/config/config.json:/opt/elastalert-server/config/config.json \
    -v `pwd`/rules:/opt/elastalert/rules \
    -v `pwd`/rule_templates:/opt/elastalert/rule_templates \
    --net="host" \
    --name elastalert bitsensor/elastalert:latest

Fish

docker run -d -p 3030:3030 \
    -v (pwd)/config/elastalert.yaml:/opt/elastalert/config.yaml \
    -v (pwd)/config/config.json:/opt/elastalert-server/config/config.json \
    -v (pwd)/rules:/opt/elastalert/rules \
    -v (pwd)/rule_templates:/opt/elastalert/rule_templates \
    --net="host" \
    --name elastalert bitsensor/elastalert:latest

Configuration

ElastAlert parameters

Installation using npm and manual ElastAlert setup

Requirements

• ElastAlert v0.0.96. We don't support other versions of ElastAlert, use them at your own risk.
• NodeJS 4.5.0 with NPM & NVM.

Building from source

1. Clone the repository

```bash
git clone https://github.com/bitsensor/elastalert.git elastalert
cd elastalert
```

1. Run nvm install "$(cat .nvmrc)" to install & use the required NodeJS version.
2. Run npm install to install all the dependencies.
3. Look at the Config section to setup the path to your ElastAlert instance.

Building

1. Run the installation guide shown above
2. Run npm run build

Install ElastAlert to /opt/elastalert

Config

{
  "appName": "elastalert-server", // The name used by the logging framework.
  "port": 3030, // The port to bind to
  "elastalertPath": "/opt/elastalert",  // The path to the root ElastAlert folder. It's the folder that contains the `setup.py` script.
  "start": "2014-01-01T00:00:00", // Optional date to start querying from
  "end": "2016-01-01T00:00:00", // Optional date to stop querying at
  "verbose": true, // Optional, will increase the logging verboseness, which allows you to see information about the state of queries.
  "es_debug": true, // Optional, will enable logging for all queries made to Elasticsearch
  "debug": false, // Will run ElastAlert in debug mode. This will increase the logging verboseness, change all alerts to DebugAlerter, which prints alerts and suppresses their normal action, and skips writing search and alert metadata back to Elasticsearch.
  "rulesPath": { // The path to the rules folder containing all the rules. If the folder is empty a dummy file will be created to allow ElastAlert to start.
    "relative": true, // Whether to use a path relative to the `elastalertPath` folder.
    "path": "/rules" // The path to the rules folder. 
  },
  "templatesPath": { // The path to the rules folder containing all the rule templates. If the folder is empty a dummy file will be created to allow ElastAlert to start.
    "relative": true, // Whether to use a path relative to the `elastalertPath` folder.
    "path": "/rule_templates" // The path to the rule templates folder.
  },
  "dataPath": { // The path to a folder that the server can use to store data and temporary files.
    "relative": true, // Whether to use a path relative to the `elastalertPath` folder.
    "path": "/server_data" // The path to the data folder.
  }
}

API

• GET /

Exposes the current version running

• GET /status

Returns either 'SETUP', 'READY', 'ERROR', 'STARTING', 'CLOSING', 'FIRST_RUN' or 'IDLE' depending on the current ElastAlert process status. 

• GET /status/control/:action

Where `:action` can be either 'start' or 'stop', which will respectively start or stop the current ElastAlert process.

• WIP GET /status/errors

When `/status` returns 'ERROR' this returns a list of errors that were triggered.

• GET /rules

Returns a list of directories and rules that exist in the `rulesPath` (from the config) and are being run by the ElastAlert process.

• GET /rules/:id

Where `:id` is the id of the rule returned by **GET `/rules`**, which will return the file contents of that rule.

• POST /rules/:id

Where `:id` is the id of the rule returned by **GET `/rules`**, which will allow you to edit the rule. The body send should be:

```javascript
{
  // Required - The full yaml rule config.
  "yaml": "..."
}
```
    

• DELETE /rules/:id

Where `:id` is the id of the rule returned by **GET `/rules`**, which will delete the given rule.

• GET /templates

Returns a list of directories and templates that exist in the `templatesPath` (from the config) and are being run by the ElastAlert process.

• GET /templates/:id

Where `:id` is the id of the template returned by **GET `/templates`**, which will return the file contents of that template.

• POST /templates/:id

Where `:id` is the id of the template returned by **GET `/templates`**, which will allow you to edit the template. The body send should be:

```javascript
{
  // Required - The full yaml template config.
  "yaml": "..."
}
```
    

• DELETE /templates/:id

Where `:id` is the id of the template returned by **GET `/templates`**, which will delete the given template.

• POST /test

This allows you to test a rule. The body send should be:

```javascript
{
  // Required - The full yaml rule config.
  "rule": "...",
  
  // Optional - The options to use for testing the rule.
  "options": {
  
    // Can be either "all", "schemaOnly" or "countOnly". "all" will give the full console output. 
    // "schemaOnly" will only validate the yaml config. "countOnly" will only find the number of matching documents and list available fields.
    "testType": "all",
    
    // Can be any number larger than 0 and this tells ElastAlert over a period of how many days the test should be run
    "days": "1"
    
    // Whether to send real alerts
    "alert": false
  }
}
``` 
    

• WIP GET /config

Gets the ElastAlert configuration from `config.yaml` in `elastalertPath` (from the config).

• WIP POST /config

Allows you to edit the ElastAlert configuration from `config.yaml` in `elastalertPath` (from the config). The required body to be send will be edited when the work on this API is done.

Contributing

Contact