DOKK / manpages / debian 12 / elastalert / elastalert.1.en

elastalert - elastalert

usage: elastalert [-h] [--config CONFIG] [--debug] [--rule RULE]

[--silence SILENCE] [--start START] [--end END] [--verbose] [--patience TIMEOUT] [--pin_rules] [--es_debug] [--es_debug_trace ES_DEBUG_TRACE]

show this help message and exit
Global config file (default: config.yaml)
Suppresses alerts and prints information instead. Not compatible with `--verbose`
Run only a specific rule (by filename, must still be in rules folder)
Silence rule for a time period. Must be used with --rule. Usage: --silence <units>=<number>, eg. --silence hours=2
YYYY-MM-DDTHH:MM:SS Start querying from this timestamp. Use "NOW" to start from current time. (Default: present)
YYYY-MM-DDTHH:MM:SS Query to this timestamp. (Default: present)
Increase verbosity without suppressing alerts. Not compatible with `--debug`
Maximum time to wait for ElasticSearch to become responsive. Usage: --patience <units>=<number>. e.g. --patience minutes=5
Stop ElastAlert from monitoring config file changes
Enable verbose logging from Elasticsearch queries
Enable logging from Elasticsearch queries as curl command. Queries will be logged to file. Note that this will incorrectly display localhost:9200 as the host/port
December 2022 elastalert 0.2.4-3