It seems that the mattermost alerter is not working properly

[nsano-rururu]

When I set mattermost_msg_fields for mattermost, I get the following error:

    ProcessController:  Traceback (most recent call last):
      File "/opt/elastalert/elastalert/loaders.py", line 271, in load_options
        self.rule_schema.validate(rule)
      File "/home/node/.local/lib/python3.8/site-packages/jsonschema/validators.py", line 353, in validate
        raise error
    jsonschema.exceptions.ValidationError: [{'title': 'Name', 'value': '{0}', 'args': ['message'], 'short': False}] is not of type 'object'
    
    Failed validating 'type' in schema['properties']['mattermost_msg_fields']:
        {'additionalProperties': False,
         'properties': {'args': {'items': {'type': 'string'},
                                 'type': ['string', 'array']},
                        'short': {'type': 'boolean'},
                        'title': {'type': 'string'},
                        'value': {'type': 'string'}},
         'type': 'object'}
    
    On instance['mattermost_msg_fields']:
        [{'args': ['message'], 'short': False, 'title': 'Name', 'value': '{0}'}]
    
    During handling of the above exception, another exception occurred:
    
    Traceback (most recent call last):
      File "/opt/elastalert/elastalert/loaders.py", line 156, in load
        rule = self.load_configuration(rule_file, conf, args)
      File "/opt/elastalert/elastalert/loaders.py", line 218, in load_configuration
        self.load_options(rule, conf, filename, args)
      File "/opt/elastalert/elastalert/loaders.py", line 273, in load_options
        raise EAException("Invalid Rule file: %s\n%s" % (filename, e))
    elastalert.util.EAException: Invalid Rule file: rules/a.yaml
    [{'title': 'Name', 'value': '{0}', 'args': ['message'], 'short': False}] is not of type 'object'
    
    Failed validating 'type' in schema['properties']['mattermost_msg_fields']:
        {'additionalProperties': False,
         'properties': {'args': {'items': {'type': 'string'},
                                 'type': ['string', 'array']},
                        'short': {'type': 'boolean'},
                        'title': {'type': 'string'},
                        'value': {'type': 'string'}},
         'type': 'object'}
    
    On instance['mattermost_msg_fields']:
        [{'args': ['message'], 'short': False, 'title': 'Name', 'value': '{0}'}]
    
    During handling of the above exception, another exception occurred:
    
    Traceback (most recent call last):
      File "/usr/lib/python3.8/runpy.py", line 194, in _run_module_as_main
        return _run_code(code, main_globals, None,
      File "/usr/lib/python3.8/runpy.py", line 87, in _run_code
        exec(code, run_globals)
      File "/opt/elastalert/elastalert/elastalert.py", line 2110, in <module>
        sys.exit(main(sys.argv[1:]))
      File "/opt/elastalert/elastalert/elastalert.py", line 2099, in main
        client = ElastAlerter(args)
      File "/opt/elastalert/elastalert/elastalert.py", line 134, in __init__
        self.rules = self.rules_loader.load(self.conf, self.args)
      File "/opt/elastalert/elastalert/loaders.py", line 164, in load
        raise EAException('Error loading file %s: %s' % (rule_file, e))
    elastalert.util.EAException: Error loading file rules/a.yaml: Invalid Rule file: rules/a.yaml
    [{'title': 'Name', 'value': '{0}', 'args': ['message'], 'short': False}] is not of type 'object'
    
    Failed validating 'type' in schema['properties']['mattermost_msg_fields']:
        {'additionalProperties': False,
         'properties': {'args': {'items': {'type': 'string'},
                                 'type': ['string', 'array']},
                        'short': {'type': 'boolean'},
                        'title': {'type': 'string'},
                        'value': {'type': 'string'}},
         'type': 'object'}
    
    On instance['mattermost_msg_fields']:
        [{'args': ['message'], 'short': False, 'title': 'Name', 'value': '{0}'}]

If you delete the following settings of mattermost_msg_fields from schema.yaml, it will work without any problem.

  mattermostField: &mattermostField
    type: object
    additionalProperties: false
    properties:
      title: {type: string}
      value: {type: string}
      args: *arrayOfString
      short: {type: boolean}

mattermost_msg_fields: *mattermostField

a.yaml

alert:
  - "mattermost"
alert_subject: "Test {0} 123 {1} aa"
alert_subject_args:
  - "message"
  - "@timestamp"
alert_text: "Test {0}  123 {1} bb"
alert_text_args:
  - "message"
  - "@timestamp"
filter:
  - query:
      query_string:
        query: "message:Quit AND @log_name:mysqld.general"
generate_kibana_discover_url: true
index: "mariadblog-*"
is_enabled: true
kibana_discover_app_url: "http://localhost:5601/app/discover#/"
kibana_discover_from_timedelta:
  minutes: 10
kibana_discover_index_pattern_id: "4babf380-c3b1-11eb-b616-1b59c2feec54"
kibana_discover_to_timedelta:
  minutes: 10
kibana_discover_version: "7.12"
mattermost_ignore_ssl_errors: false
mattermost_msg_color: "danger"
mattermost_username_override: "elastalert"
mattermost_webhook_url: "https://xxxxx"
mattermost_msg_fields:
  - title: Name
    value: "{0}"
    args: ["message"]
    short: false
name: "a"
num_events: 2
realert:
  minutes: 5
terms_size: 50
timeframe:
  minutes: 5
timestamp_field: "@timestamp"
timestamp_type: "iso"
type: "frequency"
use_strftime_index: false

[nsano-rururu]

I made a pull request
#239

[jertel]

It looks like the schema should be updated to expect an array of those field objects. Perhaps try

  mattermostField: &mattermostField
    type: object
    additionalProperties: false
    properties:
      title: {type: string}
      value: {type: string}
      args: *arrayOfString
      short: {type: boolean}

  arrayOfMattermostFields: &arrayOfMattermostField
    type: array
    items: *mattermostField

...
  mattermost_msg_fields: *arrayOfMattermostField
...

I haven't tried this, or know if this is valid schema syntax.

[nsano-rururu]

I tried. Is no problem. It was reflected in the content of the pull request.