Yelp / elastalert

Easy & Flexible Alerting With ElasticSearch
https://elastalert.readthedocs.org
Apache License 2.0
7.99k stars 1.74k forks source link

not getting hit when camparing scripted filed value in a range #2492

Open mayank023 opened 4 years ago

mayank023 commented 4 years ago

Here i'm trying to check value of scripted value lands between 60 to 30 but i'm not getting hits for that, but i can analyze data in my kibana and i can find matches.

Here is given rule file.

########################################
#  Alert if ALB not at latest version  #
########################################

# (Required)
# Rule name, must be unique
name: Alert_TLS_Certificate_Expires_In_60_To_30_Days

# (Required)
# Type of alert
type: any

# (Required)
# Index to search, wildcard supported
index: "*"

# All documents must have a timestamp field.
# ElastAlert will try to use @timestamp by default, but this can be changed with the timestamp_field option
timestamp_field: query_timestamp

# (Required, change specific)
query_key: source

# (Required)
# A list of Elasticsearch filters used for find events
# These filters are joined with AND and nested in a filtered query
# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
filter:
  - script:
      script:
        inline: ((doc['expires_on'].value.millis -  new Date().getTime()) /1000/86400) < 60 AND ((doc['expires_on'].value.millis -  new Date().getTime()) /1000/86400) > 30

# (Required)
# The alert is use when a match is found
alert:
  - command
command: ["scripts/post_new_relic.sh", "--event_type=Alert_TLS_Certificate_Expires_In_30_Days", "--key_value_list=service_id:%(service_id)s,service_environment:%(service_environment)s,source:%(source)s,name:%(name)s"]

in place of

 - script:
      script:
        inline: ((doc['expires_on'].value.millis -  new Date().getTime()) /1000/86400) < 60 AND ((doc['expires_on'].value.millis -  new Date().getTime()) /1000/86400) > 30

when i tried

 - script:
      script:
        inline: ((doc['expires_on'].value.millis -  new Date().getTime()) /1000/86400) < 60

i'm getting hits for this as expected.

mayank023 commented 4 years ago

Tried even below does not help.

- script:
      script:
        inline: ((doc['expires_on'].value.millis -  new Date().getTime()) /1000/86400) BETWEEN 30 TO 60