ELASTALERT-TEST-RULE(1)

📦 version 0.2.4, in debian bookworm

✨ ELASTALERT-TEST-RULE ✨

okay so bestie, welcome to elastalert-test-rule — it's a User Command, it lives in section 1 of the manual, and it is literally here to validate your rule configuration before it goes out into the world and embarrasses you. 🎀

🌸 NAME 🌸

elastalert-test-rule</purgle> — no cap, that's the whole name. Short, sweet, iconic. 👑

💖 DESCRIPTION 💖

Bestie. Listen. This is how you call her:

usage: elastalert-test-rule [-h] [--schema-only] [--days DAYS] [--start
START]

[--end END] [--stop-error] [--formatted-output]
       [--data FILENAME] [--alert] [--save-json FILENAME]
       [--use-downloaded] [--max-query-size MAX_QUERY_SIZE]
       [--count-only] [--config CONFIG] rule

And what does she do? Validate a rule configuration. That's it. That's the job. She checks your rule so your rule doesn't check you. 💅

🫶 positional arguments: 🫶

  • rule — the rule configuration filename, aka the glow-up you're about to vibe check. 🌸

✨ options: ✨

  • -h, --help — shows this help message and dips. The classic escape hatch. 🙈
  • --schema-only — only shows schema errors, and does not run the query. Like checking the outfit in the mirror but never leaving the house. 🪞
  • --days DAYS — queries the previous N days with this rule. Time travel, but make it N days deep. ⏳
  • --start START — YYYY-MM-DDTHH:MM:SS — start querying from this timestamp. Pick your starting point, main character. 🌟
  • --end END — YYYY-MM-DDTHH:MM:SS — query up to this timestamp. (Default: present) Use "NOW" to start from current time. (Default: present) — yes, the default is present, and also "NOW" gets you current time. Both facts stay, both facts slay. ⏰
  • --stop-error — stops the entire test right after the first error. Not me being dramatic, she is literally that girl who leaves the party the second something goes wrong. 💀
  • --formatted-output — outputs results in formatted JSON. Pretty-printed, aesthetically blessed, lowkey satisfying. ✨
  • --data FILENAME — a JSON file containing data to run the rule against. Feed her your little data snacks. 🍓
  • --alert — use actual alerts instead of debug output. Real ones only, fr fr. 🔥
  • --save-json FILENAME — a file to which documents from the last day or --days will be saved. Save it for later, bestie, it's giving archival energy. 📁
  • --use-downloaded — Use the downloaded. That's it. That's the whole description. She said what she said and left. 🦋
  • --max-query-size MAX_QUERY_SIZE — maximum size of any query. Big query, small query, this sets the ceiling. 📏
  • --count-only — only displays the number of documents matching the filter. No extras, no lore, just the number. 🔢
  • --config CONFIG — global config file. The mothership config, iykyk. 👑
🎀 Quick vibe check: if a flag says it changes behaviour, it changes behaviour. Don't guess, don't assume, just read the option. That's the whole assignment.

💜 This page is from elastalert-test-rule 0.2.4-3, dated December 2022, and it's filed under ELASTALERT-TEST-RULE(1) in the User Commands section of the manual. Periodt. Go validate your rules, bestie — you've got this. 🌈✨🫶

📦 where this page comes from