Run Rule only after another has matches

[ghost]

My ideia is to when the first rule (that checks if the status of a service is down) goes off, another rule will check if the service is still down.

Is there any possible way to achieve this?

Thanks in advance.

[jertel]

Why wouldn't you have the first rule continue to check for the service being down, and re-alert every X hours or so?

[ghost]

Yeh that makes sense. And that how it's deployed.

But the upper guys also want the alert when the service is up again.

[jertel]

Ok, that makes more sense. You can do this by adding a second "flatline" rule that monitors the elastalert* index itself for a particular rule with matches > 0, and then alerts when its stops seeing this rule.

For example, assuming you already have a rule named "Service is offline" that's working today, you can add a second rule as follows:

name: Service is back online
type: flatline
index: elastalert*
query_key: "rule_name"
filter:
- query:
    query_string:
      query: "rule_name:\"Service is offline\" AND matches:>0"
forget_keys: true
timeframe:
  minutes: 30
threshold: 1

[ghost]

What am I missing here? It got hits but no matches.

For clarifying, the jenkins_down when the service is down gets matches: 1, and then goes matches: 0 when the service is up.

No error has appeared nor the rule is silenced.

[jertel]

Has the entire timeframe elapsed since jenkins_down stopped firing?

[ghost]

I trimmed down the timeframe and tried again. It worked!

Guess it's the solution! Thanks you so much, saved me from another headache today.