Monitoring redundant WAN link

[zayalaksme]

I want to write single or multiple rules to monitor wan links of multiple locations. I want to send an alert only if google 8.8.8.8 is up and WAN link went down. May I know how to do this?

Is a single Rule can read 2 events/logs/docs at the same time?
How do we call a rule in another rule?

[jertel]

Check out the optional query_key configuration parameter: https://elastalert2.readthedocs.io/en/latest/ruletypes.html?highlight=query_key#query-key

[zayalaksme]

i am trying to generate alert only when google ip up and wan link down. I using the below rule for this. I am getting below error regarding filter. Will it work?

es_host: "10.250.10.63"
es_port: 5555
name: DOWNSERVICE
type: frequency
index: heartbeat-*
include:
  - message
  - query_key
  - url.full
  - monitor.name
  - monitor.status
  - fields.Client_Name
  - fields.WAN-IP
  - fields.Location
num_events: 05
timeframe:
  seconds: 60
filter:
- and:
     - query:
         query_string:
           query: "monitor.name: GOOGLE AND monitor.status: up"
     - query:
         query_string:
           query: "monitor.status: down"
# AND matches:>06"
#filter:
#- terms:
#    monitor.status: ["down"]
query_key: url.full
old_query_limit:
  hours: 1
alert:
- "debug"

Error I am getting is:

_[root@usla-pap-elk04 elastalert2]# 
[root@usla-pap-elk04 elastalert2]# elastalert-test-rule --config examples/config.yaml examples/rules/down.yaml 
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
            To send them but remain verbose, use --verbose instead.
WARNING:elasticsearch:GET http://10.250.10.63:5555/heartbeat-*/_search?ignore_unavailable=true&size=1 [status:400 request:0.003s]
Error running your filter:
RequestError(400, 'x_content_parse_exception', {'error': {'root_cause': [{'type': 'parsing_exception', 'reason': '[and] query malformed, no start_object after query name', 'line': 1, 'col': 150}], 'type': 'x_content_parse_exception', 'reason': '[1:150] [bool] failed to parse field [filter]', 'caused_by': {'type': 'x_content_parse_exception', 'reason': '[1:150] [bool] failed to parse field [must]', 'caused_by': {'type': 'parsing_exception', 'reason': '[and] query malformed, no start_object after query name', 'line': 1, 'col': 150}}}, 'status': 400})
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
                To send them but remain verbose, use --verbose instead.
1 rules loaded
INFO:apscheduler.scheduler:Adding job tentatively -- it will be properly scheduled when the scheduler starts
WARNING:elasticsearch:GET http://10.250.10.63:5555/heartbeat-*/_search?_source_includes=fields.WAN-IP%2Cfields.Location%2Cquery_key%2Cmonitor.status%2Cfields.Client_Name%2Curl.full%2Cmessage%2C%40timestamp%2Cmonitor.name&ignore_unavailable=true&scroll=30s&size=10000 [status:400 request:0.004s]
ERROR:elastalert:Error running query: RequestError(400, 'x_content_parse_exception', '[and] query malformed, no start_object after query name')

Would have written the following documents to writeback index (default is elastalert_status):

elastalert_error - {'message': "Error running query: RequestError(400, 'x_content_parse_exception', '[and] query malformed, no start_object after query name')", 'traceback': ['Traceback (most recent call last):', '  File "/usr/local/lib/python3.9/site-packages/elastalert/elastalert.py", line 384, in get_hits', '    res = self.thread_data.current_es.search(', '  File "/usr/local/lib/python3.9/site-packages/elasticsearch/client/utils.py", line 84, in _wrapped', '    return func(*args, params=params, **kwargs)', '  File "/usr/local/lib/python3.9/site-packages/elasticsearch/client/__init__.py", line 810, in search', '    return self.transport.perform_request(', '  File "/usr/local/lib/python3.9/site-packages/elasticsearch/transport.py", line 318, in perform_request', '    status, headers_response, data = connection.perform_request(method, url, params, body, headers=headers, ignore=ignore, timeout=timeout)', '  File "/usr/local/lib/python3.9/site-packages/elasticsearch/connection/http_requests.py", line 91, in perform_request', '    self._raise_error(response.status_code, raw_data)', '  File "/usr/local/lib/python3.9/site-packages/elasticsearch/connection/base.py", line 131, in _raise_error', '    raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)', "elasticsearch.exceptions.RequestError: RequestError(400, 'x_content_parse_exception', '[and] query malformed, no start_object after query name')"], 'data': {'rule': 'DOWNSERVICE', 'query': {'query': {'bool': {'filter': {'bool': {'must': [{'range': {'@timestamp': {'gt': '2021-07-30T15:55:19.863396Z', 'lte': '2021-07-30T15:56:20.463396Z'}}}, {'and': [{'query': {'query_string': {'query': 'monitor.name: GOOGLE AND monitor.status: up'}}}, {'query': {'query_string': {'query': 'monitor.status: down'}}}]}]}}}}, 'sort': [{'@timestamp': {'order': 'asc'}}]}}}

[root@usla-pap-elk04 elastalert2]#_
![image](https://user-images.githubusercontent.com/33970128/127685376-a55b74fc-3e96-4841-9296-6800ce35a608.png)

[jertel]

The "and", "or" queries have been replaced with "bool" in newer Elastic versions. By default, multiple filters are already ANDed so for your particular use case you should be able to simply remove the "- and:" line.

For more information please review this documentation: https://elastalert2.readthedocs.io/en/latest/recipes/writing_filters.html#

For more advanced help in writing queries, refer to the Elasticsearch docs or community support.