Skip to content

Commit

Permalink
Add post2 to the loader + use http_post2_* instead of http_post_* for…
Browse files Browse the repository at this point in the history
… HTTP Post 2
  • Loading branch information
lepouletsuisse committed Nov 1, 2021
1 parent dc4e752 commit 59d71c6
Show file tree
Hide file tree
Showing 5 changed files with 111 additions and 109 deletions.
2 changes: 1 addition & 1 deletion CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
- [Alertmanager] Added support for Alertmanager - [#503](https://github.com/jertel/elastalert2/pull/503) - @nsano-rururu
- Add summary_table_max_rows optional configuration to limit rows in summary tables - [#508](https://github.com/jertel/elastalert2/pull/508) - @mdavyt92
- Added support for shortening Kibana Discover URLs using Kibana Shorten URL API - [#512](https://github.com/jertel/elastalert2/pull/512) - @JeffAshton
- Added new alerter `HTTP Post 2` which allow more flexibility to build the body/headers of the request.
- Added new alerter `HTTP Post 2` which allow more flexibility to build the body/headers of the request. - [#512](https://github.com/jertel/elastalert2/pull/530) - @lepouletsuisse

## Other changes
- [Docs] Add exposed metrics documentation - [#498](https://github.com/jertel/elastalert2/pull/498) - @thisisxgp
Expand Down
28 changes: 14 additions & 14 deletions docs/source/ruletypes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -2217,36 +2217,36 @@ This alert is a more flexible version of the HTTP Post alerter.

Required:

``http_post_url``: The URL to POST.
``http_post2_url``: The URL to POST.

Optional:

``http_post_payload``: List of keys:values to use for the payload of the HTTP Post. You can use {{ field }} (Jinja2 template) in the key and the value to reference any field in the matched events (works for nested fields). If not defined, all the Elasticsearch keys will be sent. Ex: `"description_{{ my_field }}": "Type: {{ type }}\\nSubject: {{ title }}"`
``http_post2_payload``: List of keys:values to use for the payload of the HTTP Post. You can use {{ field }} (Jinja2 template) in the key and the value to reference any field in the matched events (works for nested fields). If not defined, all the Elasticsearch keys will be sent. Ex: `"description_{{ my_field }}": "Type: {{ type }}\\nSubject: {{ title }}"`

``http_post_raw_fields``: List of keys:values to use as the content of the POST. Example - ip:clientip will map the value from the clientip field of Elasticsearch to JSON key named ip. This field overwrite the keys with the same name in `http_post_payload`.
``http_post2_raw_fields``: List of keys:values to use as the content of the POST. Example - ip:clientip will map the value from the clientip field of Elasticsearch to JSON key named ip. This field overwrite the keys with the same name in `http_post2_payload`.

``http_post_headers``: List of keys:values to use for as headers of the HTTP Post. You can use {{ field }} (Jinja2 template) in the key and the value to reference any field in the matched events (works for nested fields). Ex: `"Authorization": "{{ user }}"`. Headers `"Content-Type": "application/json"` and `"Accept": "application/json;charset=utf-8"` are present by default, you can overwrite them if you think this is necessary.
``http_post2_headers``: List of keys:values to use for as headers of the HTTP Post. You can use {{ field }} (Jinja2 template) in the key and the value to reference any field in the matched events (works for nested fields). Ex: `"Authorization": "{{ user }}"`. Headers `"Content-Type": "application/json"` and `"Accept": "application/json;charset=utf-8"` are present by default, you can overwrite them if you think this is necessary.

``http_post_proxy``: URL of proxy, if required. only supports https.
``http_post2_proxy``: URL of proxy, if required. only supports https.

``http_post_all_values``: Boolean of whether or not to include every key value pair from the match in addition to those in http_post_payload and http_post_static_payload. Defaults to True if http_post_payload is not specified, otherwise False.
``http_post2_all_values``: Boolean of whether or not to include every key value pair from the match in addition to those in http_post2_payload and http_post2_static_payload. Defaults to True if http_post2_payload is not specified, otherwise False.

``http_post_timeout``: The timeout value, in seconds, for making the post. The default is 10. If a timeout occurs, the alert will be retried next time elastalert cycles.
``http_post2_timeout``: The timeout value, in seconds, for making the post. The default is 10. If a timeout occurs, the alert will be retried next time elastalert cycles.

``http_post_ca_certs``: Set this option to ``True`` if you want to validate the SSL certificate.
``http_post2_ca_certs``: Set this option to ``True`` if you want to validate the SSL certificate.

``http_post_ignore_ssl_errors``: By default ElastAlert 2 will verify SSL certificate. Set this option to ``False`` if you want to ignore SSL errors.
``http_post2_ignore_ssl_errors``: By default ElastAlert 2 will verify SSL certificate. Set this option to ``False`` if you want to ignore SSL errors.

Example usage::

alert: post
http_post_url: "http://example.com/api"
http_post_payload:
alert: post2
http_post2_url: "http://example.com/api"
http_post2_payload:
description: "An event came from IP {{clientip}}"
username: "{{user.name}}"
http_post_raw_fields:
http_post2_raw_fields:
ip: clientip
http_post_headers:
http_post2_headers:
authorization: Basic 123dr3234
X-custom-type: {{type}}

Expand Down
24 changes: 12 additions & 12 deletions elastalert/alerters/httppost2.py
Original file line number Diff line number Diff line change
Expand Up @@ -10,22 +10,22 @@

class HTTPPost2Alerter(Alerter):
""" Requested elasticsearch indices are sent by HTTP POST. Encoded with JSON. """
required_options = frozenset(['http_post_url'])
required_options = frozenset(['http_post2_url'])

def __init__(self, rule):
super(HTTPPost2Alerter, self).__init__(rule)
post_url = self.rule.get('http_post_url', None)
post_url = self.rule.get('http_post2_url', None)
if isinstance(post_url, str):
post_url = [post_url]
self.post_url = post_url
self.post_proxy = self.rule.get('http_post_proxy', None)
self.post_payload = self.rule.get('http_post_payload', {})
self.post_raw_fields = self.rule.get('http_post_raw_fields', {})
self.post_all_values = self.rule.get('http_post_all_values', not self.post_payload)
self.post_http_headers = self.rule.get('http_post_headers', {})
self.post_ca_certs = self.rule.get('http_post_ca_certs')
self.post_ignore_ssl_errors = self.rule.get('http_post_ignore_ssl_errors', False)
self.timeout = self.rule.get('http_post_timeout', 10)
self.post_proxy = self.rule.get('http_post2_proxy', None)
self.post_payload = self.rule.get('http_post2_payload', {})
self.post_raw_fields = self.rule.get('http_post2_raw_fields', {})
self.post_all_values = self.rule.get('http_post2_all_values', not self.post_payload)
self.post_http_headers = self.rule.get('http_post2_headers', {})
self.post_ca_certs = self.rule.get('http_post2_ca_certs')
self.post_ignore_ssl_errors = self.rule.get('http_post2_ignore_ssl_errors', False)
self.timeout = self.rule.get('http_post2_timeout', 10)

def alert(self, matches):
""" Each match will trigger a POST to the specified endpoint(s). """
Expand Down Expand Up @@ -71,5 +71,5 @@ def alert(self, matches):
elastalert_logger.info("HTTP Post alert sent.")

def get_info(self):
return {'type': 'http_post',
'http_post_webhook_url': self.post_url}
return {'type': 'http_post2',
'http_post2_webhook_url': self.post_url}
2 changes: 2 additions & 0 deletions elastalert/loaders.py
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import elastalert.alerters.gitter
import elastalert.alerters.googlechat
import elastalert.alerters.httppost
import elastalert.alerters.httppost2
import elastalert.alerters.line
import elastalert.alerters.pagertree
import elastalert.alerters.rocketchat
Expand Down Expand Up @@ -111,6 +112,7 @@ class RulesLoader(object):
'servicenow': elastalert.alerters.servicenow.ServiceNowAlerter,
'alerta': elastalert.alerters.alerta.AlertaAlerter,
'post': elastalert.alerters.httppost.HTTPPostAlerter,
'post2': elastalert.alerters.httppost2.HTTPPost2Alerter,
'pagertree': elastalert.alerters.pagertree.PagerTreeAlerter,
'linenotify': elastalert.alerters.line.LineNotifyAlerter,
'hivealerter': elastalert.alerters.thehive.HiveAlerter,
Expand Down
Loading

0 comments on commit 59d71c6

Please sign in to comment.