Elastalert2 rules folder config not working

564 views Asked by At

I'm using Elastalert2 now to get notifications from error log in slack.

We need to receive alarms of all service logs through our dozens of rules.

Docker builds ElastAlert2 and deploy it on Argocd.

But, there is a problem that the rules_folder config does not work

There is rules_folder in config.yaml

 rules_folder: /home/elastalert/rules

and this is Example Dockerfile

FROM python:3.9.13-slim

# installation
RUN pip3 install --upgrade pip \
  && pip3 install cryptography elastalert2

ENV LANG="en_US.UTF-8"

# add configuration and alarm
RUN mkdir -p /home/elastalert
WORKDIR /home/elastalert

ADD ./config.yaml /home/elastalert
COPY ./rules /home/elastalert/rules

and this is run command

    command: [ "/bin/sh", "-c" ]
        args:
          - >-
            echo "Finda Elastalert is started!!" &&
            elastalert-create-index &&
            elastalert --verbose --config config.yaml
            
            ...

but error occur like... [error][1]

I think the rule files cannot be imported as args. In other words, it seems that rules_folder does not apply

If, specify a specific rule file in the start command, it works well. For example,

 elastalert --verbose --config config.yaml --rule ./rules/example/example.yaml

However, it can only execute one rule.

We have dozens of rules.

What's the problem?

1

There are 1 answers

0
Ola On

Solve.

Don't store empty yaml in your rules/ sub.

The problem was that I commented out all the yaml files except the test rule yaml for the operation test.

By replacing the commented yaml file with another extension such as .text.

Now elastalert recognizes and operates all rules.