johnsusek / praeco

Elasticsearch alerting made simple.
GNU General Public License v3.0
549 stars 88 forks source link

Support for ElastAlert2 'summary_table_type' option #636

Closed sinister3vil closed 7 months ago

sinister3vil commented 7 months ago

🎉 Goal

Support summary_table_type field with ascii, html and markdown options in UI.

💪 Motivation

There's currently no support for this and aggregated e-mail alerts are coming in as ascii, but not monospace, and appear quite ugly.

A different approach would be supporting direct editing of the rule YAML and any throw a message in the UI if there are unsupported options, something like "Rule includes summary_table_type option which is not supported in Praeco. Please use the YAML editor to change this option".

nsano-rururu commented 7 months ago

Is it necessary to be able to set summary_table_fields on the screen?

image

sinister3vil commented 7 months ago

Hello @nsano-rururu,

Do you mean having it as a UI option vs setting it in a config as a global setting?

nsano-rururu commented 7 months ago

UI

sinister3vil commented 7 months ago

Well, I believe it should be configurable per rule, cause some times you may need an HTML format, others markdown and others you'd be fine with just ascii. Do you find there's no value in having it in the UI? If not, how would it be set?

nsano-rururu commented 7 months ago

summary table image

The following are the setting items Only summary_table_type is required

summary_table_type   ascii or markdown is option button

summary_prefix  text

summary_suffix  text

summary_table_max_rows  number

summary_table_fields UI like below image

nsano-rururu commented 7 months ago

If you want to use the same settings for all rules, Write it in the following file of rules

BaseRule.config