elasticsearch - 对于特定规则，ElastAlert每小时而不是每分钟发出警报

Question

我有ElastAlert服务，该服务每分钟发送一次警报。我现在已经配置了flatline规则，以便在过去一个小时内没有新数据时提醒我。

正如预期的那样，rule运行了一个小时以确保没有任何事件进入。但是随后，它开始每分钟发送一次警报(尊重配置)。如何更改此设置，并告诉ElastAlert在此特定规则上每小时而不是每分钟提醒我一次？

Answer 1

您可以将realert config选项设置为60分钟吗？ (默认为1)

Realert

realert realert: This option allows you to ignore repeating alerts for a period of time. If the rule uses a query_key, this option will be applied on a per key basis. All matches for a given rule, or for matches with the same query_key, will be ignored for the given time. All matches with a missing query_key will be grouped together using a value of _missing. This is applied to the time the alert is sent, not to the time of the event. It defaults to one minute, which means that if ElastAlert is run over a large time period which triggers many matches, only the first alert will be sent by default. If you want every alert, set realert to 0 minutes. (Optional, time, default 1 minute)