Need to reboot elastalert to apply changes in blacklist file

[ghost]

Hello. Need to reboot elastalert to apply changes in blacklist file.

name: DNS Query Blacklist index: test-* filter:

• term: event_type: "dns"
• term: dns.type: "query" type: blacklist compare_key: "dns.rrname" timeframe: minutes: 30 blacklist:
  • "!file /opt/lists/dns_blacklist" alert:
  • "email" email:
  • "email@email.email"

Please, add detect and reload configuration changes in blacklist file automatically.

[jtavan]

I've noticed this as well - it's a real problem for folks creating dynamic white/black lists, as it requires a cycle of the elastalert process to update. Elastalert can already detect changes to configuration files using load_rule_changes, so it would be good to extend that model to all white and blacklist files referenced by rules.

[nick-george]

+1. Or possibly support a HUP signal that would force Elastalert to reload all rules and associated files.