How can we use elastalert to read metrics from statsd/telegraf and capture CPU and memory utlization in the alerts

[gyancoupa]

I saw in elastalert doc, config like statsd_host in config.yml but not much information on how to do it.

[jertel]

The statsd config is used for pushing performance metrics out to a statsd host, not for collecting data from a statsd host. ElastAlert currently only alerts on data read from an Elasticsearch or OpenSearch host.

[jertel]

The documentation I pasted earlier walks you through the creation of an example enhancement. Please follow those instructions. Add a print('ENHANCING') line to your my_enhancement.py and then run Elastalert 2 when a test rule that you know will cause an alert. Verify that you can see ENHANCING printed to your console. If you get that far then your enhancement is working,and you can work on formatting your date and placing it into a new match['my_new_date'] field. Then reference that new field from within your rule.

[gyancoupa]

Thanks a lot, @jertel for your help and guidance, I think I am very close now, just one problem at the last stage.
So I need to add start and end date in grafana link in my elastalert based alerts, now I am able to read the end date from the epoch timestamp value converted by the code in the enhancements.py using {3} placeholder but how about the start date?
If I understand correctly at one time I can read only one value being set in the match['@timestamp'] in the enhancement.py, how to read the other timestamp value for the start date

Pleass find below the rules.yml file
alert_text: "*Message*: {0}\n*Grafana_Dashboard_Link*: https://*********&from=1685086200000&to={3}" alert_text_args: ["message","stage","deployment","@timestamp"]

The enhancement.py

`class MyEnhancement(BaseEnhancement):

# The enhancement is run against every match
# The match is passed to the process function where it can be modified in any way
# ElastAlert 2 will do this for each enhancement linked to a rule
def process(self, match):
    print('ENHANCING')
    t=match['@timestamp']
    import calendar
    from dateutil.parser import parse as date_parse
    dt =  date_parse(t)
    timestamp1 = calendar.timegm(dt.timetuple())
    epoc=timestamp1
    print("epoc is:",epoc)
    match['@timestamp']=epoc`

[jertel]

If you're trying to show a Grafana time range that includes your alert timestamp, you might want to consider creating a start/end date range that equally straddles the timestamp (it will be directly in the middle of your time range. For example, suppose your @timestamp lands on 15:45:35. You could use a 30 minute time range, and subtract half of that range (15 minutes) from the front to get your start value (15:30:35), and then add 15 minutes to the end to get your end value (16:00:35). Code example:

def process(self, match):
    print('ENHANCING')
    t=match['@timestamp']
    import calendar
    from dateutil.parser import parse as date_parse
    dt =  date_parse(t)
    timestamp1 = calendar.timegm(dt.timetuple())
    epoc=timestamp1
    print("epoc is:",epoc)
    
    # 30 minutes = 1800 seconds
    time_range = 1800 
    half_range = time_range/ 2
    match['start_time']= epoc - half_range
    match['end_time']= epoc + half_range

[gyancoupa]

Hi @jertel I have actually now got the whole logic working now using test alert method and I got to now submit the PR, now just one silly issue I am getting.

my rules.yaml and the enhancements.py I got to keep as per the below folder structure in elastalert server and I can't keep the py file same as yaml.

elastalert/clp/rules.yaml
elastalert/enhancements/date_to_epoch

Now how can I reference the date_to_epoch.py file in a.yaml as it is present outside its parent direct?
The below syntax in rules.yaml does not work and I do not want to give an absolute path

match_enhancements:

• "../enhancements.date_to_epoch.EpochTimeConverter"

[jertel]

The enhancement directory should be a subdir of the current working directory from which Elastalert is launched. If you are using a Docker container, then the subdir should be in /opt/elastalert/enhancements. With that you specify the directory name

match_enhancements:
  - enhancements.date_to_epoch.EpochTimeConverter

If you need to do something unique for your use case, where the enhancements subdir cannot exist in that location, you will need to adjust the Python sys path yourself.