Adds --silence_qk_value option to elastalert

This enables the user to silence a rule only for a specific query_key value and
not only the whole rule.
See elastalert Issue: Yelp#2777

elastalert/config.py

@@ -48,6 +48,11 @@ def parse_args(cls, args) -> argparse.Namespace:
             help="Silence rule for a time period. Must be used with --rule. Usage: "
             "--silence <units>=<number>, eg. --silence hours=2",
         )
+        parser.add_argument(
+            "--silence_qk_value",
+            dest="silence_qk_value",
+            help="Silence the rule only for this specific query key value.",
+        )
         parser.add_argument(
             "--start",
             dest="start",

elastalert/elastalert.py

@@ -664,7 +664,12 @@ def silence(self, silence_cache_key=None):
 
         first_rule = next(iter(self.rules.values()))
         if not silence_cache_key:
-            silence_cache_key = first_rule["name"] + "._silence"
+            if config.CFG().args.silence_qk_value:
+                silence_cache_key = (
+                    first_rule["name"] + config.CFG().args.silence_qk_value
+                )
+            else:
+                silence_cache_key = first_rule["name"] + "._silence"
 
         try:
             silence_ts = parse_deadline(config.CFG().args.silence)