Bugfix - elastalert.util.format_index

[jmacdone]

I didn't tick all the boxes for a proper PR, but see: jmacdone@38b7c1f

In short, I'm using logstash-%Y.%m.%d.%H (i.e. hourly indexes), but the format_index is only tuned for daily indexes (the default for logstash). This checks for %H in the index pattern and changes to using a hours=1 timedetla. Better way?

[nsano-rururu]

It's an issue, not a pull request. Please submit a pull request.

[jertel]

I don't see an issue with this approach if you do want to submit a proper PR with all the requirements. I'm converting this issue into a Discussion since it doesn't represent a bug in the project, but more represents a discussion around a potential enhancement.

[jmacdone]

I'll submit a PR*. It look like the pattern is to open a pull request, then add a commit to update CHANGELOG.md with whatever the URL for the PR ends up being. Is that correct?

*And, yes, it did need unit tests. The first try "works on my machine" but failed the existing unit tests with some off-by-one errors.

[jertel]

Yes, that's the correct PR process.