Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add aggregation_alert_time_compared_with_timestamp_field documentation #1588

Merged
merged 2 commits into from
Dec 4, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
- None

## Other changes
- None
- [Docs] Add missing documentation of the `aggregation_alert_time_compared_with_timestamp_field` option. - [#1588](https://github.com/jertel/elastalert2/pull/1588) - @nicolasnovelli

# 2.22.0

Expand Down
11 changes: 11 additions & 0 deletions docs/source/ruletypes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -526,6 +526,17 @@ aggregate_by_match_time
Setting this to true will cause aggregations to be created relative to the timestamp of the first event, rather than the current time. This
is useful for querying over historic data or if using a very large buffer_time and you want multiple aggregations to occur from a single query.

aggregation_alert_time_compared_with_timestamp_field
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

``aggregation_alert_time_compared_with_timestamp_field``: This option controls how aggregation works when a rule processes events
older than ``current time - aggregation window`` and ``aggregate_by_match_time`` is set to true. Defaults to false.
When false, the expected send timestamp of the pending alert (waiting for additional events to aggregate) is compared with the current time.
As a result, following events will not be aggregated with the pending alert, because it is considered already notified,
leading to past events being notified one by one instead of being grouped together.
When true, it allows the aggregation of events with old timestamps, as long as they are within the aggregation window.
(Optional, boolean, default false)

realert
^^^^^^^

Expand Down
Loading