Recreate container, rule doesn't work

[WalterZhangYTTXG]

I want to use elastalert2 in another environment, so I test the new rules in the new environment, etc.
The elastalert-test-rule test is OK, but doesn't work.

When I tried to remove the container in the elder environment, and recreate the container wirh the same command. It looks like doesn't work like the new environment.

o, I doubt it may be the recreate error!!!

The create command is docker run -d --name elastalert --restart=always -v /usr/local/etc/elastalert/config.yaml:/opt/elastalert/config.yaml:ro -v /usr/local/etc/elastalert/rules:/opt/elastalert/rules:ro -v /usr/local/etc/elastalert/smtp_auth_file.yaml:/opt/elastalert/smtp_auth_file.yaml:ro -v /usr/local/etc/elastalert/certs:/opt/elastalert/certs:ro -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro jertel/elastalert2 --verbose

The logs like:
Reading Elastic 8 index mappings:
Reading index mapping 'es_mappings/8/silence.json'
Reading index mapping 'es_mappings/8/elastalert_status.json'
Reading index mapping 'es_mappings/8/elastalert.json'
Reading index mapping 'es_mappings/8/past_elastalert.json'
Reading index mapping 'es_mappings/8/elastalert_error.json'
Index elastalert_status already exists. Skipping index creation.
INFO:elastalert:2 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999913 seconds
INFO:elastalert:Background configuration change check run at 2022-11-11 20:40 CST
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2022-11-11 20:40 CST
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999784 seconds
INFO:elastalert:Background configuration change check run at 2022-11-11 20:41 CST
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2022-11-11 20:41 CST
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999726 seconds
INFO:elastalert:Background configuration change check run at 2022-11-11 20:42 CST
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2022-11-11 20:42 CST
……

When I add the --es_debug_trace /tmp/es.log, the info is:
curl -H 'Content-Type: application/json' -XPOST 'http://localhost:9200/elastalert_status/_search?pretty&size=1000' -d '{
"query": {
"bool": {
"filter": {
"range": {
"alert_time": {
"from": "2022-11-09T12:40:00.289209Z",
"to": "2022-11-11T12:40:00.289329Z"
}
}
},
"must": {
"query_string": {
"query": "!exists:aggregate_id AND alert_sent:false"
}
}
}
},
"sort": {
"alert_time": {
"order": "asc"
}
}
}'
……

[nsano-rururu]

When I tried to remove the container in the elder environment, and recreate the container wirh the same command. It looks like doesn't work like the new environment.

It's just not possible to delete and re-acquire the docker image of jertel/elastalert2 in the old environment. that

[nsano-rururu]

Run "docker rmi jertel/elastalert2:latest" first like below

docker rmi jertel/elastalert2:latest
docker run -d --name elastalert --restart=always -v /usr/local/etc/elastalert/config.yaml:/opt/elastalert/config.yaml:ro -v /usr/local/etc/elastalert/rules:/opt/elastalert/rules:ro -v /usr/local/etc/elastalert/smtp_auth_file.yaml:/opt/elastalert/smtp_auth_file.yaml:ro -v /usr/local/etc/elastalert/certs:/opt/elastalert/certs:ro -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro jertel/elastalert2 --verbose

[nsano-rururu]

If you don't like it, specify the version each time. As below

docker run -d --name elastalert --restart=always -v /usr/local/etc/elastalert/config.yaml:/opt/elastalert/config.yaml:ro -v /usr/local/etc/elastalert/rules:/opt/elastalert/rules:ro -v /usr/local/etc/elastalert/smtp_auth_file.yaml:/opt/elastalert/smtp_auth_file.yaml:ro -v /usr/local/etc/elastalert/certs:/opt/elastalert/certs:ro -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro jertel/elastalert2:2.8.0 --verbose

[WalterZhangYTTXG]

Well, Thank you!

Maybe my description is not accurate enough! My English is pool.

When I woke up in the morning, I got lots of email alert! Everything works OK!!!
And I find out the reason. The Timezone!!!

My host timezone is: UTC+8
And I didn't query_timezone: in the config.yaml, didn't set env TZ (default is UTC).

So, when I add query_timezone: "Asia/Shanghai" and create container with --env TZ='Asia/Shanghai', it works!!!
I can see the Queried in the logs.
INFO:elastalert:Background configuration change check run at 2022-11-12 18:35 CST
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2022-11-12 18:35 CST
INFO:elastalert:Queried rule pfSense high priority Event from 2022-11-12 18:33 CST to 2022-11-12 18:35 CST: 1 / 1 hits