How to give one week timeframe to rules ?

[iamrahulramesh]

Hi I am making a rule of flatline to find if events are less than certain number in one week time frame, Currently I am using timeframe hours, Is there any way where I can automate the date process like "current date to current date + 7 "???

`name: Flatline_apnews
type: flatline
index: logstash-*
threshold: 5

#The time period that must contain less than threshold events.
timeframe:
hours: 168

filter:

• query:
  match:
  sources: "google.com"

alert:

• "ms_teams"
  alert_subject: Weekly volume of google is less
  alert_subject_args: []
  alert_text: Please check for any anomalies for google
  alert_text_args: []
  ms_teams_webhook_url: webhook.office.com/xxx
  ms_teams_alert_summary : "Alert, weekly threshold level of google is less"`

[jertel]

It's already automated; You don't have to specify the current date since it will automatically use the current date/time and look backwards 168 hours to see if enough events occurred. Instead of

timeframe:
  hours: 168

you can use

timeframe:
  days: 7

Perhaps you could clarify your question?

[iamrahulramesh]

Thanks for the response @jertel .
What I am trying to do is making an alert system which can alert me if the weekly count is less than a certain threshold number from the day i run the rule. so is there any option like where i can mention the dates for the rule to run and it automatically update itself once the week passes ?

[jertel]

I still don't understand. Do you want to run the rule only once a week, and have it alert you only at that time that you run it? If so, search this discussion forum as there have been multiple answers to similar questions.

[iamrahulramesh]

@jertel I want it to run automatically ,say every monday . I dont want to run it every week. it should run each week on its own.

[jertel]

https://elastalert2.readthedocs.io/en/latest/ruletypes.html#limit-execution