Yelp / elastalert

Easy & Flexible Alerting With ElasticSearch
https://elastalert.readthedocs.org
Apache License 2.0
8k stars 1.73k forks source link

@timestamp is UTC-0 how do i change it? #3268

Closed annastudio closed 2 years ago

annastudio commented 2 years ago

Нello! In kibana the time is displayed correctly (UTC + 3). But the email sent from elastalert its still in UTC-0 is there anyway to force it to show up as UTC +3? I've already done: elastalert_modules\my_enhancements.py

from elastalert.util import pretty_ts
from elastalert.enhancements import BaseEnhancement

class TimeEnhancement(BaseEnhancement):
    def process(self, match):
        if '@timestamp' in match:
            ts = match['@timestamp']
            if isinstance(ts, str) and ts.endswith('Z'):
                match['@timestamp_local'] = pretty_ts(ts)

rules\rule1.yaml

name: "alert test"

type: any

realert:
  minutes: 0

index: winlogbeat-*
timestamp_field: "@timestamp"
match_enhancements:
- elastalert_modules.my_enhancements.TimeEnhancement

filter:
- terms:
    event.code: ["4740", "4720"]

include:
  - "@timestamp"
alert_text: "The alert occured at {}"
alert_text_args:
   - "@timestamp_local"

alert_text_type: alert_text_only

alert:
- "email"
email_format: html
email:
- "someone@somewhere.com"
from_addr: "someone@somewhere.com"

smtp_host: "smtp.somewhere.com"
smtp_port: 25

The rule works when I run elastalert --config config.yaml --verbose --rule rules\rule1.yaml and alerts are sent. But in normal mode, nothing comes to the mail. Help me please!

Solution #861 didn't work for me.