Yelp / elastalert

Easy & Flexible Alerting With ElasticSearch
https://elastalert.readthedocs.org
Apache License 2.0
7.97k stars 1.73k forks source link

Sample Rule question #3218

Open roman-tasi opened 2 years ago

roman-tasi commented 2 years ago

I am running my test rule command and am getting this:

elastalert_status - {'rule_name': 'Lockout Alerting', 'endtime': datetime.datetime(2021, 9, 28, 18, 52, 47, 137084, tzinfo=tzutc()), 'starttime': datetime.datetime(2021, 9, 28, 17, 52, 11, 137084, tzinfo=tzutc()), 'matches': 76742, 'hits': 76742, '@timestamp': datetime.datetime(2021, 9, 28, 18, 54, 48, 709983, tzinfo=tzutc()), 'time_taken': 118.85222268104553}

Basically I don't know why my matches is equal to my hits. Also it isn't logical for me to have 76742 matches. Also the sample rule command is printing this out repeatedly:

silence - {'exponent': 0, 'rule_name': 'Lockout Alerting.10.100.10.83', '@timestamp': datetime.datetime(2021, 9, 28, 18, 54, 46, 435723, tzinfo=tzutc()), 'until': datetime.datetime(2021, 9, 28, 18, 55, 46, 435708, tzinfo=tzutc())}

but obviously with different IPs and timestamps, but all have the silence tag.

Can anyone help?