Elastalert: [question] Can I run Elastalert on every ES nodes in the cluster?

[adrianlop]

will it sinchronize every elastalert instance via elastalert_status? or Elastalert only must run in one node?

[Qmando]

Do not run multiple instances of ElastAlert at the same time unless they are running separate rules. Weird things will happen otherwise.

[adrianlop]

thank you @Qmando !

[soodye]

How is fault tolerance achieved by people using ElastAlert?

[wittyameta]

Do not run multiple instances of ElastAlert at the same time unless they are running separate rules. Weird things will happen otherwise.
@Qmando Weird things like what? Can I run multiple instances if I don't care about duplicate alerts?

[Qmando]

@wittyameta

Duplicate alerts is the major one.

There are likely some other features, like aggregation, that may not work right.

You're certainly welcome to try it and report back, I haven't fully thought of all the possible implications.