Create recurring silences for a given rule

[CaGix22]

Hi all!

I have been testing the --silence command line, which I found really helpful to silence alerts for a certain amount of time. I was wondering if it is possible to create "recurring silences" for a given rule. For example, I want to set a rule to be silenced only on weekends. Would it be something like:

--rule <rule_name.yml> --silence <saturdays> and <sundays>

Or, if I know that I receive an alert everyday at 19:00, instead of manually creating the silence at that time everyday, maybe sth like:

--rule <rule_name.yml> --silence from <YYYYMMDD:HHSS> to <YYYYMMDD:HHSS> everyday

Also, is it possible to unsilence a rule after using --silence?

From what I've read, it seems ElastAlert doesn't support recurring silences directly. However, maybe some of you have implemented something similar or have other ideas on how to achieve this? I'd appreciate any suggestions!

[jertel]

There isn't the ability to specifiy complex silence arguments. What others do in this situations is either:

1. tune the rule to exclude known false positives, or
2. only execute the rule during certain times of the day/week

For 1, your rule would need to include the exclusion of those times/days in the query filter itself.

For 2, you can use the limit_execution rule parameter.

[CaGix22]

Hi Jertel! Thanks for your help and sorry for my late answer. But! I did read your comment and I already discarded point 2 because limit_execution does not help me in this situation. You already help me dealing with that in these threads: 1416 and 1426

Now, I liked point 1 about tuning the rule query. I tried with the range parameter but it seems that ElastAlert ignores it, anyway! I believe that is the good path to follow but I need help with enabling the debugging logs so I can see the actual query that it is making into ElasticSearch.

I tried in the rule config with alert - debug, I saw that --debug is not the same as enabling the debug logs but had no luck. Can you or someone from the community help me with it? What am I missing to add in the global config so i can see in my console those logs with level DEBUG? Thanks!

[CaGix22]

Update:
I did it! I made some changes and got the debug level logs working! Now I’ll be able to debug the queries and investigate the use of boolean queries to tune the rule to exclude known false positives.

I followed the config yaml example indication and removed from my config the entire file: block (and the - file line at the end). Also I ran the container with --debug command.

---

Old answer:
Hi! Nevermind, I found the info to enable debug in the docs and config.yml

However, I encountered a permissions error when I tried to execute the container with --debug which might be related to the configuration in my container:

PermissionError: [Errno 13] Permission denied: '/opt/elastalert/elastalert.log' I'll keep trying. If anyone has any suggestions or ideas, they would be really appreciated!