Elastalert: Q: Can we set global rule config options?

[naseemkullah]

Such as kibana_url, instead of setting it in every rule?

TIA

[naseemkullah]

I suppose if they are set in /opt/config ?

[thommor]

Yes you can.

Just place it in your config.yaml

[naseemkullah]

Thanks @thommor,

However I am trying to add some things globally, such as index (then omitting from the rules) but am getting errors saying that index is a required field.

Same story for alert.

e.g. My elastalert_config.yaml contains:

  elastalert_config: |-
    ---
[...]
    alert:
    - slack
    index: '*'
[...]

But does not seem to propagate to rules.

[thommor]

The reason you get this error is because the rule is ran against a validator before the options from the config are copied into the rule. This means you will get this error for any option that is required required_locals = frozenset(['alert', 'type', 'name', 'index']).

To get around this you would have to check if one of there required locals is in the global config and copy it to the rule before it is passed to the validator but you would have to ask @Qmando whether that would be accepted as a PR

The rule is passed to the validator here
The global config options are copied to the rule here

[naseemkullah]

Thanks for the explanation @thommor .

So if I understand correctly, we can apply global options in our config.yaml that will be propagated to all rules except for the required_locals mentioned.

I think that would suffice for the time being, however if you and/or @Qmando see value in being able to define any of the required_locals globally, I can take a stab at it, especially since you've showed which are the files in question.

[naseemkullah]

PS @thommor I've created a PR for the helm chart regarding this ability to add global rule options in the config.yaml, if you have a moment feel free to have a look and chime in!

https://github.com/helm/charts/pull/11160/files

[thommor]

Looks fine to me

[naseemkullah]

Thanks!
Closing this issue.