jertel / elastalert2

ElastAlert 2 is a continuation of the original yelp/elastalert project. Pull requests are appreciated!
https://elastalert2.readthedocs.org
Apache License 2.0
902 stars 284 forks source link

fix scan timeframe with use_terms_query #1097

Closed rschirin closed 1 year ago

rschirin commented 1 year ago

Description

Following issue https://github.com/Yelp/elastalert/issues/3041 and PR https://github.com/Yelp/elastalert/pull/3141, when a rule has [scan_entire_timeframe: true] and [use_terms_query: true or use_count_query: true], the timeframe (i.e. 5 days) is evaluated correctly just at first run; from the second one, the timeframe will be set accordly to run_every value (i.e. 5 minutes). This change only affects rules with option use_count_query or use_term_query.

Checklist

Questions or Comments