Elastalert: Cannot send alerts to telegram?

[fnzv]

Hello,
I'm trying to send ES alerts to telegram with elastalert but i keep getting this error:
ERROR:root:Error while running alert telegram: Error posting to Telegram: 400 Client Error: Bad Request
Config:

alert:
- "email"
- "telegram"
# (required, email specific)
# a list of email addresses to send alerts to
email:
- "myemail"
#
telegram_bot_token: mytelegram_token_without_quotes
#
telegram_room_id: "@mytelegram_username" # i tried also group id and the bot room id but nothing

My configuration is working with emails, i don't know if i'm missing something on the telegram config?

[Qmando]

Is the email really big? https://core.telegram.org/method/messages.sendMessage#return-errors says a 400 could mean >4096 characters. I should actually truncate and enforce that limit now that I know it exists.

If you put a debug point here, https://github.com/Yelp/elastalert/blob/master/elastalert/alerts.py#L725, you could probably see the reason for the 400.

[fnzv]

Thank you.. i tried to send messages via curl and i found that the telegram_room_id works only with the chat_id that you get with api.telegram.com//getUpdates
Now the elastalert works with telegram.

[ruifigueiredo]

Hi Mormaii, i use chat id in telegram_room_id = 'chat_id'

try to get the chat_id from https://api.telegram.org/bot/getUpdates

You can use "chat":{"id": 29299292 to send msg to groups or to personal contact.

[Mormaii]

@ruifigueiredo It worked like that, is there any way to customize the alert message? without having to edit ruletypes.py (my python isn't good)

[ruifigueiredo]

@Mormaii Yap you can use:

alert_text: "custom alert text: {0} {1}"
alert_text_args: ["field0","field1"]

[ruifigueiredo]

@Mormaii why you delete and edit your questions with different contexts of the original?
https://snag.gy/qDMJbc.jpg
please check this link https://elastalert.readthedocs.io/en/latest/running_elastalert.html#creating-a-rule

[Mormaii]

@ruifigueiredo I wanted to create a separate issue so now to hijack this one. That link you sent me has no info on alert_text whatsoever

Is there any way to do operations on the alert_text?

example:

alert_text: |
    Bot ha detectado un uso de CPU {1} en {0} # I want to multiply {1} by 100
alert_text_args:
  - hostname
  - proc.cpu.user_p

[ruifigueiredo]

@Mormaii please you need to use the fields hostname or proc.cpu.user_p or others in place of my example.

alert_text_args: ["field0","field1"] -> alert_text_args:["hostname","proc.cpu.user.p"]

[Mormaii]

Already works like that, what I'm asking is to do math operations on the text

[q2dg]

Documentation is a mesh