Elastalert: log file for elastalert

[tkumark]

Hi

Is there a log file for elastalert when we run it as Supervisor? Recently there was some issues on live but elastalert did not trigger an alert. we could not find any log file to see why no alerts where triggered.

We stopped supervisor and ran it manually in verbose mode to see that elastic search was timing out when elastalert was trying to connect.

Also is there a way to get an alert if elastaalert is not able connect to elastic search ? This would be really helpful.

Thanks

[mza97]

Supervisor log ?

[program:elastalert-0-5]
command=/usr/local/bin/elastalert --config /Path/elastalert/configFiles/5min/config.yaml --verbose 
process_name=elastalert-0-5
autorestart=true
startsecs=15
stopsignal=INT
stopasgroup=true
killasgroup=true
stderr_logfile=/var/log/elastalert-0-5_stderr.log
stderr_logfile_maxbytes=5MB

[Trustys]

I use this rule to generate an alert for elastalert error :

type: any
filter:
    - term:
        _type: elastalert_error
index: elastalert_status

alert_subject: "Error on rule elastalert "

alert_text_kw:
     data: data

alert_text: |
    Error elastalert :

    - {data}

EDIT : this cannot help to detect elasticsearch time out since it needs elasticsearch to generate the alert....

[IngaFeick]

+1 on the need for a proper logfile, preferably one that can be specified as a command line option.