limit_execution_coverage param behavior #1426
-
Hi! So Jertel gave us valuable info about the limit_execution_coverage parameter here. We need to detect logs at: 14:25:11UTC (And from that, every 4 hours logs) Our rule config:
We noticed in the logs that EA makes a tiny query at the beggining of the cron and then it splits.
The problem is that the tiny execution from 14:25:00 to 14:25:00 is a match, because it doesn't find the 14:25:11 logs (by 11 seconds). Could someone explain why or how can we get rid of that execution or any idea? We already tried: "25,45 2/4 * * 0-5" (same behavior) , "25 2/4 * * 0-5" (starts Pausing forever and never executes). Please take in consideration that limit_execution_coverage MUST remain true. Thanks for the help!!! |
Beta Was this translation helpful? Give feedback.
information
Extension to send alerts only within a specific time range
https://github.com/0xSeb/elastalert_hour_range