Queries regarding functioning of elastalert2

[ishukeshri2712]

Hi community, I want to learn few points about
Elastalert,

1. Suppose we have an elastalert rule for time stamp set to 5 minutes so is it like it will query only the data in between this period to elasticsearch?
2. Suppose we put run_every parameter to 1 minutes so with timestamp 5 minutes then every one minute addition it will query duplicate documents in this time period
3. Suppose we didn’t put the timestamp field then what will happens will it query all the documents in the given index ?
4. What is the best run_every value we should set for a particular use case ?
5. What is the best buffer_time parameter we should use?
   Plse help me Thanks in Advance ✌️

[ishukeshri2712]

@jertel plse explain

[jertel]

I'm having trouble understanding these questions. Did you read the documentation and all of the parameters related to timing?

ElastAlert 2 requires records to have a timestamp field.

run_every values depend on each user's use case. Same with buffer_time.

I recommend (re) reading the documentation because these topics are explained in that documentation.