peopleperhour/elastalert

Docker image for the elasticalert by YELP with Alpine base image

More information regarding how to write rules http://elastalert.readthedocs.org/en/latest/recipes/writing_filters.html and some example rules https://github.com/Yelp/elastalert/tree/master/example_rules

This container will check if there is data inside the /opt/rules directory and if not then it will download the rules from s3 bucket.

The name of the bucket as well as the credentials to access the bucket (IAM user) are passed as env vars (see bellow Environment Variables)

The container is based on the https://hub.docker.com/r/ivankrizsan/elastalert/ docker container with addition of s3 download rules.

Build

make

Local Testing

You have to first build the container with make

docker run --rm -it -v $(PWD)/:/opt/rules  \
        -e ELASTICSEARCH_HOST=192.168.66.6 \
        peopleperhour/elastalert bash;

$ mv /opt/config/config.yaml /opt/config/config.tpl.yaml
$ envsubst < /opt/config/config.tpl.yaml > /opt/config/config.yaml

You can now run the elastalert-test-rule to validate your rules

bash-4.3# elastalert-test-rule --help
usage: elastalert-test-rule [-h] [--schema-only] [--days DAYS]
                            [--data FILENAME] [--alert] [--save-json FILENAME]
                            [--count-only] [--config CONFIG]
                            rule

Validate a rule configuration

positional arguments:
  rule                  rule configuration filename

optional arguments:
  -h, --help            show this help message and exit
  --schema-only         Show only schema errors; do not run query
  --days DAYS           Query the previous N days with this rule
  --data FILENAME       A JSON file containing data to run the rule against
  --alert               Use actual alerts instead of debug output
  --save-json FILENAME  A file to which documents from the last day or --days
                        will be saved
  --count-only          Only display the number of documents matching the
                        filter
  --config CONFIG       Global config file.

Example:

bash-4.3# elastalert-test-rule \
  --config /opt/config/config.yaml \
  --days 1 \
  example_rule.yaml;

Environment Variables

• ELASTICSEARCH_HOST: the elasticsearch host
• S3_BUCKET: the bucket that holds the rules
• AWS_ACCESS_KEY_ID : The IAM key
• AWS_SECRET_ACCESS_KEY : The IAM secrete
• AWS_DEFAULT_REGION: The region where the bucket is.

Volumes

/opt/logs - Elastalert and Supervisord logs will be written to this directory.
/opt/config - Elastalert (elastalert_config.yaml) and Supervisord (elastalert_supervisord.conf) configuration files.
/opt/rules - Contains Elastalert rules.