Maintenance mode enabled dinamically

[rschirin]

Hey there,
I am using Elastalert2 via Docker image and I would like to know if there is a way to dinamically use the flag --silence for a specific rule. I would not restart the container to do that.

[jertel]

You have a some options:

1. Launch another elastalert process with the --silence param into the already running Docker container, via docker exec elastalert elastalert --config /opt/elastalert/config.yaml --rule noisy_rule.yaml --silence hours=4.
2. Use a third-party tool, such as elastabot, which can silence rules via a Slack command.
3. Write your own Elasticsearch client that can manipulate the elastalert_silence index directly.

[rschirin]

You have a some options:

1. Launch another elastalert process with the --silence param into the already running Docker container, via docker exec elastalert elastalert --config /opt/elastalert/config.yaml --rule noisy_rule.yaml --silence hours=4.
2. Use a third-party tool, such as elastabot, which can silence rules via a Slack command.
3. Write your own Elasticsearch client that can manipulate the elastalert_silence index directly.

1. probably I should run it on the host that contains Docker containers? is it right?
2. I cannot use it
3. do you mean, for instance, a basic query that add a new document into elastalert_silence index?

[jertel]

1. Yes, run it on the same host that is hosting the elastalert container.
2. You can reference the source code to see how it modifies the index to adjust the silencing duration.
3. See 2 above.

[nsano-rururu]

3. Write your own Elasticsearch client that can manipulate the elastalert_silence index directly.

https://user-images.githubusercontent.com/611996/52892144-90a19300-3155-11e9-8050-cb4a440411a4.png

johnsusek/elastalert-server
https://github.com/johnsusek/elastalert-server
https://hub.docker.com/r/praecoapp/elastalert-server
johnsusek/praeco
https://github.com/johnsusek/praeco
https://hub.docker.com/r/praecoapp/praeco

https://designetwork.daichi703n.com/entry/2019/03/24/Praeco-ElastAlert-GUI

Silence解除(Unsilence) ※動作検証途中
現状、GUIではSilence設定を解除する項目がない。ElastAlert自身に該当するコマンド等がないため納得。記載の方法でSilence解除は可能だが、運用を考慮して要検討。

Silence設定はpraeco_elastalert_status_silenceのindexに保存されている。

untilの内容を現在時刻で更新し、Praecoを再起動することで、Silenceを実質解除できる。ドキュメントIDを検索・使用するため運用に難あり...。また、ElastAlert単体で--silenceを使用した際は再起動不要でSilence解除できたが、Praecoとの組み合わせ時は再起動が必要だった。(詳細動作仕様は未調査)

[nsano-rururu]

3. Write your own Elasticsearch client that can manipulate the elastalert_silence index directly.

elastalert creates several indexes. Check the index with the elasticsearch you are using.
https://elastalert2.readthedocs.io/en/latest/elastalert_status.html