what happens when we click on test button on elastalert kibana plugin?

[the-arcade-01]

when we click on test button, does elastalert re-pulls all the data again from elasticsearch to check for alerts? as when i click on test button it also gives me past alerts information. Does elastalert stores the data and if then how many hrs older data is stored?

PS: image is for telling the button

[nsano-rururu]

Ask the developer of the plugin
https://github.com/Karql/elastalert-kibana-plugin

[nsano-rururu]

It's open source, so it's faster to look at the source code

ElastAlert 2 ran over the last 24 hours to test the output of alerts that may have fired. The alert is not actually sent to the alert notification destination.

Karql/elastalert-kibana-plugin

Rebuild bitsensor/elastalert-kibana-plugin with new kibana-plugin. Also added functionality

https://github.com/Karql/elastalert-kibana-plugin/blob/master/public/components/rules/editor/editor.tsx#L81

    httpClient
      .post(`../api/elastalert/test`, {
        body: JSON.stringify({
          rule: this.state.value,
          options: {
            testType: 'all'
          }
        })
      })

Karql/elastalert2-server

Reworked bitsensor/elastalert with typescript. bug fixes etc.

https://github.com/Karql/elastalert2-server/blob/master/src/models/test/test-rule-options.model.ts#L35

export const TestRuleOptionsDefaults : TestRuleOptions = {
    testType: "all",
    days: 1,
    alert: false,
    // format: null    
    maxResults: 0
}

bitsensor/elastalert
https://github.com/bitsensor/elastalert

POST /test

{
  // Required - The full yaml rule config.
  "rule": "...",
  
  // Optional - The options to use for testing the rule.
  "options": {
  
    // Can be either "all", "schemaOnly" or "countOnly". "all" will give the full console output. 
    // "schemaOnly" will only validate the yaml config. "countOnly" will only find the number of matching documents and list available fields.
    "testType": "all",
    
    // Can be any number larger than 0 and this tells ElastAlert over a period of how many days the test should be run
    "days": "1"
    
    // Whether to send real alerts
    "alert": false,

    // Return results in structured JSON
    "format": "json",

    // Limit returned results to this amount
    "maxResults": 1000
  }
}