Thank your for your great work. But, when it comes to production enviroment, I would like to suggest the option of running multiple instances of Elastalert to help scale overall workload. This can be particularly beneficial when some rules do not utilize the "use_count_query" option, as it can help prevent the backend from running out of memory. With the API you have been working on, achieving this scalability is quite possible, and it may only require the addition of a controller module.
🐛 Summary
(Question summary)
Thank your for your great work. But, when it comes to production enviroment, I would like to suggest the option of running multiple instances of Elastalert to help scale overall workload. This can be particularly beneficial when some rules do not utilize the "use_count_query" option, as it can help prevent the backend from running out of memory. With the API you have been working on, achieving this scalability is quite possible, and it may only require the addition of a controller module.
👀 Operating environment
latest , future