Elastalert: Sending alerts to file

[romanvog]

Is there an option to redirect alerts to a file using "command"?

[Qmando]

Not directly, but you could do

alert: command
command: ["tee", "-a", "/path/to/file.txt"]
pipe_match_json: true

You could also use part of the match in the file path, such as

command: ["tee", "-a", "/alerts/%{username}s.log"]

where username must be a field in the documents which match the alert.

[romanvog]

output comes out messy, so if you need to have it the way it's being sent to email try this:

cat /path/to/file.txt | grep -v "INFO" | tr "," "n" | sed 's/"@log_name":/nn"@log_name":/' | sed 's/"//g' > /path/to/new_file.txt