Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inappropriate query interval when using limit_execution for flatline rules after pausing #3177

Open
MarcelRoth opened this issue Apr 20, 2021 · 0 comments

Comments

@MarcelRoth
Copy link

Hi,
I have the following problem when using the "limit_execution" feature together with the option "limit_execution_coverage" in rules of type flatline. We use the limit_execution feature in order to not trigger an alert for a limited time frame in the night where the query in the rule will find any hits. Just because the job that is queried is paused for that time frame. Of course want to prevent any alerting in this time frame.
If we configure the rule accordingly using limit_execution and limit_execution_coverage, everything is fine for the paused time interval but the next execution after the pause does neither respect the buffer_time settings not the timeframe configuration. The rule is queried from 01:00:00 to 01:00:xy so for a too short time window.
I had a look in the code and in my opinion the reason for the too small query time window is, that the rule property "minimum_starttime" and "previous_endtime" are set to the same value as "next_starttime" (method reset_rule_schedule in elastalert.py)
Yet, maybe I missed something. I'd appreciate any comment.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant