Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix a bug where realert doesnt respect query_key when using flatline #1179

Merged
merged 3 commits into from
Jun 22, 2017
Merged

fix a bug where realert doesnt respect query_key when using flatline #1179

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a206ff1
fix a bug where realert doesnt respect query_key when using flatline
Qmando Jun 21, 2017
d1e9f5a
argument ordering is hard
Qmando Jun 21, 2017
ee5a5c3
Added unicode to get_query_key_value flatline exception
Qmando Jun 22, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions elastalert/elastalert.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@
from elasticsearch.exceptions import ElasticsearchException
from elasticsearch.exceptions import TransportError
from enhancements import DropMatchException
from ruletypes import FlatlineRule
from util import add_raw_postfix
from util import cronite_datetime_to_timestamp
from util import dt_to_ts
Expand Down Expand Up @@ -686,6 +687,9 @@ def get_segment_size(self, rule):

def get_query_key_value(self, rule, match):
# get the value for the match's query_key (or none) to form the key used for the silence_cache.
# Flatline ruletype sets "key" instead of the actual query_key
if isinstance(rule['type'], FlatlineRule) and 'key' in match:
return match['key']
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you should still go through get_named_key_value, but pass key instead of query_key, so that you can get the benefits that come with it (unicode stuff, using lookup_es_key for better handling of complex keys)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

get_named_key_value won't work for this. It takes a key name then looks up the value of that key in the rule. Passing 'query_key' might return rule['username'] for example. I will add a unicode( ) though.

return self.get_named_key_value(rule, match, 'query_key')

def get_aggregation_key_value(self, rule, match):
Expand Down