I am trying to setup elastalert setup for my elasticsearch cluster to send email alert when specific threshold met, but i always get below message.
"INFO:elastalert:Ran Example frequency rule from 2023-03-08 21:38 UTC to 2023-03-08 21:38 UTC: 0 query hits (0 already seen), 0 matches, 0 alerts sent"
And i dont see any alert in my mailbox also in elastalert index i dont see any information, i also tried to run the elastalert in debug mode but could not get any details
Below command to start elastalert:
python -m elastalert.elastalert --debug --verbose --start NOW --config examples/config.yaml --rule examples/rules/example_frequency.yaml
Responce:
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
To send them but remain verbose, use --verbose instead.
INFO:elastalert:Note: --debug and --verbose flags are set. --debug takes precedent.
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
To send them but remain verbose, use --verbose instead.
INFO:elastalert:1 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.99987 seconds
INFO:elastalert:Queried rule Example frequency rule from 2023-03-08 21:41 UTC to 2023-03-08 21:41 UTC: 0 / 0 hits
INFO:elastalert:Skipping writing to ES: {'rule_name': 'Example frequency rule', 'endtime': '2023-03-08T21:41:42.725885Z', 'starttime': '2023-03-08T21:41:27.724852Z', 'matches': 0, 'hits': 0, '@timestamp': '2023-03-08T21:41:42.739104Z', 'time_taken': 0.013174772262573242}
INFO:elastalert:Ran Example frequency rule from 2023-03-08 21:41 UTC to 2023-03-08 21:41 UTC: 0 query hits (0 already seen), 0 matches, 0 alerts sent
INFO:elastalert:Example frequency rule range 15
i tried running application in debug mode to get any information but no useful information got
i have configured the 0365 smtp information in rule file with smtp port 587 & 25 (no ssl) both but still same issue
email:
- "user1@mydomain.com"
smtp_host: "smtp.office365.com"
smtp_port: 587
smtp_ssl : true
from_addr: "user1@mydomain.com"
smtp_auth_file: "/opt/elastalert2/examples/rules/auth.yaml"
