Add realert_key feature #1004
Add realert_key feature #1004
Conversation
| @@ -1675,7 +1675,7 @@ def silence(self, silence_cache_key=None): | |||
| # With --rule, self.rules will only contain that specific rule | |||
| if not silence_cache_key: | |||
| if self.args.silence_qk_value: | |||
| silence_cache_key = self.rules[0]['name'] + "." + self.args.silence_qk_value | |||
| silence_cache_key = self.rules[0]['realert_key'] + "." + self.args.silence_qk_value | |||
| else: | |||
| silence_cache_key = self.rules[0]['name'] + "._silence" | |||
There was a problem hiding this comment.
I'm wondering if this line 1680, and line 888, should also use the new rule['realert_key'] instead of rule['name']. If you made that change it would let users run elastalert from the command line, with the silence args and still silence an entire group of alerts instead of only one alert. For backward compatibility, line 888 could still check for rule['name'] + "._silence" so that pre-upgrade silenced rules remain silenced after the upgrade, but also check for `rule['realert_key'] + "._silence". Thoughts?
I can see how this contribution could be useful to some folks. Thanks for submitting the PR!
There was a problem hiding this comment.
I didn't do it for that because they may just want to manually silence a specific rule. Maybe there needs to be an option for both ?
There was a problem hiding this comment.
Ok, that's fine with me to leave it as-is. I'll leave this open through tomorrow for any others to review.
There was a problem hiding this comment.
Sounds good to me. Thanks for your quick reply in anycase.
Description
Add realert_key option to rules that defaults to the rule name. Allows you to reuse the silence cache for multiple rules. We use this for account lockouts, if a user triggers multiple lockout rules, we don't want to call the lockout scripts multiple times.
Checklist
make test-dockerwith my changes.Questions or Comments
Unsure if I need to write a specific test for this, since it is just a modification of what is set in the
silence_cache_key, but I can write one if desired.