Merge pull request #1179 from Yelp/fix_flatline_realert_qk

fix a bug where realert doesnt respect query_key when using flatline

elastalert/elastalert.py

@@ -25,6 +25,7 @@
 from elasticsearch.exceptions import ElasticsearchException
 from elasticsearch.exceptions import TransportError
 from enhancements import DropMatchException
+from ruletypes import FlatlineRule
 from util import add_raw_postfix
 from util import cronite_datetime_to_timestamp
 from util import dt_to_ts
@@ -686,6 +687,9 @@ def get_segment_size(self, rule):
 
     def get_query_key_value(self, rule, match):
         # get the value for the match's query_key (or none) to form the key used for the silence_cache.
+        # Flatline ruletype sets "key" instead of the actual query_key
+        if isinstance(rule['type'], FlatlineRule) and 'key' in match:
+            return unicode(match['key'])
         return self.get_named_key_value(rule, match, 'query_key')
 
     def get_aggregation_key_value(self, rule, match):