sc250024/elastalert repository overview

⁠docker-elastalert

Docker image for running Elastalert.

⁠Features

• Docker container that conforms to The Twelve-Factor App Section III⁠ configuration guidelines by making everything available using environment variables.
• Integration with the following external services via environment variables:
  • E-mail (General SMTP)
  • Exotel
  • Gitter
  • HipChat
  • JIRA
  • OpsGenie
  • PagerDuty
  • Slack
  • Telegram
  • Twilio
  • VictorOps
• NTP syncrhonization
• Rules checking on container startup if rules/ directory is populated

⁠Usage

Locally the docker-elastalert instance can be run using the following command:

docker-compose up -d --build

The local cluster spins up a dummy Elasticsearch container, and then the Elastalert container. When the Elastalert container starts, the CMD script runs through the following processes:

• Checks the Elastalert rules located in ${RULES_FOLDER} if any exists
• Sets container timezone to ${CONTAINER_TIMEZONE} if the ${SET_CONTAINER_TIMEZONE} is set to True. The default is Etc/UTC.
• Starts the NTP daemon for time synchronization. This requires the following Linux capabilities set via cap_add: SYS_NICE and SYS_TIME.
• Populates the Elastalert template located at ${CONFIG_DIR}/elastalert_config.yaml.tmpl with environment variables using the dockerize binary.
• Loops a wget command until the Elasticsearch instance located at ${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT} becomes available.
• Runs elastalert-create-index if the specified ${ELASTALERT_INDEX} hasn't yet been created,
• Executes the python daemon.

⁠Credit

• Dockerize project for populating configuration templates: jwilder/dockerize⁠
• Dumb-init system used for proper forking off of PID 1: Yelp/dumb-init⁠
• Much of this repositiory was based off of the docker-elastalert repo from krizsan: krizsan/elastalert-docker⁠

⁠Environment Variables

⁠Set at buildtime

These variables are set during the Docker build, and are generally necessary for running core functionality of Elastalert.

⁠Set at runtime

These variables are settings available in the Elastalert configuration file. Most of these settings apply to third-party integrations (JIRA, OpsGenie, etc), or are things documented here: Elastalert common configuration options⁠