ELASTALERT(1)

💖 ELASTALERT 💖

okay bestie, gather round, because we're about to talk about elastalert — a whole User Commands girlie living her best life in section 1 of the manual. she's literally just called elastalert. that's it. that's the name. iconic behavior tbh. 🦋

---

✨ DESCRIPTION ✨

so like, here's the whole vibe of how you run her:

usage: elastalert [-h] [--config CONFIG] [--debug] [--rule RULE]
       [--silence SILENCE] [--start START] [--end END] [--verbose]
       [--patience TIMEOUT] [--pin_rules] [--es_debug] [--es_debug_trace
       ES_DEBUG_TRACE]

that's the whole entrance. she walks in, she says that, she does her thing. no notes. 👑

---

🎀 options: 🎀

not me listing every single one of these because we do NOT skip the boring parts in this house 💅

• -h, --help — shows you this help message and then dips out. exit stage left. very "thanks for coming to my ted talk" of her. 🙈
• --config CONFIG — points at the global config file. the default is config.yaml, so if you don't say anything she's just gonna go look there. she's predictable like that. 🍓
• --debug — suppresses alerts and prints information instead. lowkey useful for snooping on what she's doing. not compatible with --verbose though, so pick a lane bestie. 😭
• --rule RULE — runs only one specific rule, by filename. and yes she means it: it must still be in the rules folder. no sneaking files in from your desktop. 🚫
• --silence SILENCE — silences a rule for a time period. must be used with --rule, they're a package deal, a duo, a two-piece set. usage goes like this:

--silence <units>=<number>

so for example, --silence hours=2 — that's two whole hours of peace and quiet. serene. 🧘

• --start START — takes a YYYY-MM-DDTHH:MM:SS timestamp and starts querying from there. you can also just write "NOW" if you wanna start from the current time. the default is present. 🕐
• --end END — takes a YYYY-MM-DDTHH:MM:SS timestamp and queries up to it. the default is, you guessed it, present. ⏳
• --verbose — cranks up the verbosity without suppressing alerts, so you get all the words AND all the alerts. not compatible with --debug. choose your fighter. ⚔️
• --patience TIMEOUT — the maximum time to wait for ElasticSearch to become responsive. she will wait, but she has limits. usage:

--patience <units>=<number>

for example, --patience minutes=5 — five minutes of her standing there politely. 🌸

• --pin_rules — stops ElastAlert from monitoring config file changes. she stops looking. she's committed. she's locked in. 🔒
• --es_debug — enables verbose logging from Elasticsearch queries. all the tea, spilled. 🫖
• --es_debug_trace ES_DEBUG_TRACE — enables logging from Elasticsearch queries as a curl command. queries get logged to a file. > heads up though: this will incorrectly display localhost:9200 as the host/port, so don't come for her when that looks weird, she warned you. 💀

---

and that's the whole page bestie, we ate and left absolutely zero crumbs. this was elastalert version 0.2.4-3, dated December 2022, and honestly? she's giving vintage but make it useful. slay, stay hydrated, and read your configs. mwah 💖✨🎀🦋🌸💅🫶