@timestamp is UTC-0 how do i change it?

[annastudio]

Нello!
In kibana the time is displayed correctly (UTC + 3).
But the email sent from elastalert its still in UTC-0 is there anyway to force it to show up as UTC +3?
I've already done:
elastalert_modules\my_enhancements

from elastalert.util import pretty_ts
from elastalert.enhancements import BaseEnhancement

class TimeEnhancement(BaseEnhancement):
    def process(self, match):
        if '@timestamp' in match:
            ts = match['@timestamp']
            if isinstance(ts, str) and ts.endswith('Z'):
                match['@timestamp_local'] = pretty_ts(ts)

rules\rule1.yaml

name: "alert test"

type: any

realert:
  minutes: 0

index: winlogbeat-*
timestamp_field: "@timestamp"
match_enhancements:
- elastalert_modules.my_enhancements.TimeEnhancement

filter:
- terms:
    event.code: ["4740", "4720"]

include:
  - "@timestamp"
alert_text: "The alert occured at {}"
alert_text_args:
   - "@timestamp_local"
 
alert_text_type: alert_text_only

alert:
- "email"
email_format: html
email:
- "[email protected]"
from_addr: "[email protected]"

smtp_host: "smtp.somewhere.com"
smtp_port: 25

The rule works when I run elastalert --config config.yaml --verbose --rule rules\rule1.yaml and alerts are sent.
But in normal mode, nothing comes to the mail.
Help me please!

[jertel]

I see two problems in your post:

1. Times are in the wrong timezone in the alert emails
2. Alert emails do not show up in the inbox

Do you mean that emails DO show up without your enhancement, but stop showing up when you add the enhancement configuration? If so, you will need to review the ElastAlert 2 log to see what is happening. Most likely there is an error that will point you in the right direction.

[annastudio]

Hello! Please tell me how to start the logging correctly. Right now I'm running it like this elastalert --config config.yaml --verbose --rule rules_folder/rule1.yaml --debug and there are no errors in the logs. The date is correct, but the mail messages still have no date.
elasalert.log:
2022-10-24 10:47:44,562 INFO elastalert Alert for test at 2022-10-24T07:47:37.614Z: 2022-10-24 10:47:44,563 INFO elastalert <h2>A monitored security event has occurred</h2><p>4625 - Event Action: logon-failed</p><p>Timestamp Alert: 2022-10-24 10:47 MSK</p>

[jertel]

From the docs:

[annastudio]

At the moment my config looks like this:

# This is the folder that contains the rule yaml files
# Any .yaml file will be loaded as a rule
rules_folder: rules

# How often ElastAlert will query Elasticsearch
# The unit can be anything from weeks to seconds
run_every:
  minutes: 1

# ElastAlert will buffer results from the most recent
# period of time, in case some log sources are not in real time
buffer_time:
  minutes: 15

# The Elasticsearch hostname for metadata writeback
# Note that every rule can have its own Elasticsearch host
es_host: localhost

# The Elasticsearch port
es_port: 9200

# The AWS region to use. Set this when using AWS-managed elasticsearch
#aws_region: us-east-1

# The AWS profile to use. Use this if you are using an aws-cli profile.
# See http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
# for details
#profile: test
profile: default

# Optional URL prefix for Elasticsearch
#es_url_prefix: elasticsearch

# Connect with TLS to Elasticsearch
#use_ssl: True

# Verify TLS certificates
#verify_certs: True

# GET request with body is the default option for Elasticsearch.
# If it fails for some reason, you can pass 'GET', 'POST' or 'source'.
# See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport
# for details
#es_send_get_body_as: GET

# Option basic-auth username and password for Elasticsearch
#es_username: someusername
#es_password: somepassword

# Use SSL authentication with client certificates client_cert must be
# a pem file containing both cert and key for client
#verify_certs: True
#ca_certs: /path/to/cacert.pem
#client_cert: /path/to/client_cert.pem
#client_key: /path/to/client_key.key

# The index on es_host which is used for metadata storage
# This can be a unmapped index, but it is recommended that you run
# elastalert-create-index to set a mapping
writeback_index: elastalert_status
writeback_alias: elastalert_alerts

# If an alert fails for some reason, ElastAlert will retry
# sending the alert until this time period has elapsed
alert_time_limit:
  days: 2

# Custom logging configuration
# If you want to setup your own logging configuration to log into
# files as well or to Logstash and/or modify log levels, use
# the configuration below and adjust to your needs.
# Note: if you run ElastAlert with --verbose/--debug, the log level of
# the "elastalert" logger is changed to INFO, if not already INFO/DEBUG.
logging:
  version: 1
  incremental: false
  disable_existing_loggers: false
  formatters:
    logline:
      format: '%(asctime)s %(levelname)+8s %(name)+20s %(message)s'

  handlers:
    console:
      class: logging.StreamHandler
      formatter: logline
      level: INFO
      stream: ext://sys.stderr

    file:
      class : logging.FileHandler
      formatter: logline
      level: INFO
      filename: /etc/elastalert/log/elastalert.log

  loggers:
    elastalert:
      level: INFO
      handlers: []
      propagate: true

    elasticsearch:
      level: INFO
      handlers: []
      propagate: true

    elasticsearch.trace:
      level: INFO
      handlers: []
      propagate: true

    '':  # root logger
      level: INFO
      handlers:
        - console
        - file
      propagate: false

Logs in elastalert.log are written only when elasticalert is run with --debug/--verbose

[jertel]

Does the user running ElastAlert2 have access to write a log file at this location? filename: /etc/elastalert/log/elastalert.log? That's not a normal output location for log files.

[annastudio]

Hello!
I have the rights, I was able to run the rule after I changed the filter (alerts come to the mail with the correct time).

filter:
- query:
    query_string:
      query: "event.code: 4720 OR event.code: 4722 OR event.code: 4725 OR event.code: 4740 OR event.code: 4767"

I had another working rule, it was moved, but somehow keeps sending alerts. And when adding other rules in .yaml format in rules_folder/ folder, they don't work (although they were running before).
Maybe you can tell me how this is possible?

[jertel]

Without the logs it will be very difficult to assist. You will need to resolve the logging issue first.