Endtime not working with alert_text_jinja and how to convert it to IST

[firdausa-iprogrammer]

Hi Everyone,

So there are 2 things I want to achieve in alert_text_jinja
i. I'm able to get the starttime field in my alert_text however endtime doesn't work.
ii. I need to convert starttime and endtime to IST instead of UTC.

Could anyone help with both?

[jertel]

I don't believe that endtime is available by default.

As for formatting and timezone manipulation, each variable can be manipulated directly through method calls on that variables, or via Jinja filters. Ex:

{{ starttime.strftime('%Y-%m-%d %H:%M %z') }}

I suggest reading up on Jinja to see what is possible.

The alternative solution to both (i) and (ii) is to implement your own ElastAlert enhancement. Read up on how to do this here: https://elastalert2.readthedocs.io/en/latest/recipes/adding_enhancements.html

With an enhancement you could populate a current time variable to be used as the endtime value, and also format the times to a specific timezone.

[firdausa-iprogrammer]

Hi @jertel ,

Just an extension of this question, is it possible to get the buffer_time rule config in the enhancement?

[jertel]

The BaseEnhancement's __init__ method assigns the rule object to itself on line 11 of enhancements.py. So I would expect you to have access to the rule object including its config values.

[firdausa-iprogrammer]

I've been trying with self.rule['buffer_time'] but it just gives me a blank output.
Anything in particular I need to import or use to have it read the config value?

The objective is to read the buffer_time value from the rule config and use that in the time_utc_10 variable in the timedelta calculation.

That will allow me to use the same enhancement for multiple alerts

[jertel]

If self.rule is None then most likely the enhancements are not being constructed as originally intended. I suggest dumping (via print) the keys of self, self.rule, and match out to console (from within the process() method to find out what you have access to. If it turns out that you only have access to match data then you'd need to submit a PR to adjust the elastalert.py logic to invoke the .process(match) method with a new rule parameter.

  enhancement.process(match, rule)

[firdausa-iprogrammer]

Really sorry self.rule did work I had the wrong enhancement in my test rule file!
🤦‍♂️

Thanks for the help again!!