Yelp/elastalert
Elastalert
ElastAlert is an alerting framework and query monitor for Elasticsearch. It functions as a real-time log monitoring tool and event notification engine that scans indices for specific patterns to trigger automated alerts when predefined rules are matched.
The system distinguishes itself through specialized detection logic, including event spike detection, event frequency monitoring, field change tracking, and the identification of new terms within data fields. It handles notification noise via stateful alert suppression to prevent redundant messages and provides time-windowed aggregation to group multiple events into single summary reports.
The framework covers a broad range of operational capabilities, including log anomaly detection, infrastructure monitoring, and historical data auditing. It features a pluggable system for dispatching notifications to third-party messaging platforms and ticketing systems, and includes command-line tools for debugging rules against historical datasets.
Features
- Elasticsearch Alerting - Monitors Elasticsearch indices for specific patterns and triggers automated notifications when predefined rules are matched.
- Field - Triggers alerts when a specific field value changes between documents sharing the same identifier.
- Event Filtering Rules - Scans indices using predefined query filters to identify specific documents that trigger an alert notification.
- Event Spike Detection - Triggers alerts when the rate of events increases by a specific factor compared to previous periods.
- Polling Mechanisms - Periodically queries the data store for new documents within a moving time window to detect matching events.
- Notification Dispatchers - Provides a notification dispatcher that routes alerts to external services including chat and incident management platforms.
- Anomaly Detection - Identifies unusual spikes in event frequency or the appearance of new terms in system logs.
- Data Pattern Monitoring - Scans indices for anomalies and spikes to trigger alerts when predefined data conditions are met.
- Elasticsearch Alerting Frameworks - Functions as a comprehensive alerting framework and query monitor for Elasticsearch indices.
- Elasticsearch Query Monitors - Executes periodic queries against Elasticsearch to track field changes and identify new terms in data.
- Index Pattern Monitoring - Scans data indices for specific patterns to trigger notifications when predefined rules are met.
- Infrastructure Monitoring - Tracks field changes and monitors data patterns to detect system failures or performance degradation.
- Event Frequency Monitoring - Provides alerting based on the frequency of specific events occurring within a defined time window.
- New Term Identification - Triggers alerts when a previously unseen value appears in one or more specified data fields.
- Log Stream Monitors - Scans data streams for anomalies, spikes, and frequency changes to detect operational issues.
- Stateful Alert Suppression - Prevents redundant notifications for the same event by tracking the timing and attributes of previous alerts.
- Monitoring Logic Auditing - Tests alert rules against past data and scans specific time windows to verify monitoring logic.
- Historical Data Querying Interfaces - Allows setting start and stop timestamps for the monitoring process to analyze historical data.
- Time-Window Aggregations - Buffers matching documents over a set period to send a single summary report instead of individual alerts.
- Developer Notification Handlers - Provides a modular system of alert dispatchers to deliver formatted notifications to external communication platforms.
- Index Pattern Resolvers - Resolves target search indices at runtime using glob patterns to support time-rotated or dated indices.
- Incident Notification Services - Dispatches automated alerts from data queries to external messaging platforms and ticketing systems.
- Duplicate Alert Suppression - Prevents redundant notifications by enforcing a minimum time interval between alerts or grouping by field keys.
- Alerting Logic Engines - Supports implementing custom rule types and handlers for specialized monitoring paradigms and unique notification targets.
- Third-Party Integrations - Dispatches match alerts to external communication platforms, ticketing systems, or messaging applications.
- Alerting Rule Validators - Allows users to test alerting rules against historical data to verify filter matches and simulate triggers.
- Notification Aggregation - Groups multiple events occurring over a period into a single notification delivered on a scheduled basis.
- Observability Data Aggregators - Combines individual match events into periodic summaries and aggregate counts for specific data fields.
- Alert Message Customization - Formats notification messages using custom text, string arguments, or a restricted list of document fields.
- AI & Machine Learning - Modular rules-based alerting system.
- Data Analytics and Applications - Framework for alerting on anomalies in Elasticsearch data.
- Data Applications - Framework for alerting on anomalies and patterns in Elasticsearch.
- Detection and Alerting Platforms - Framework for alerting on anomalies in Elasticsearch data.
- Monitoreo y observabilidad - Flexible alerting framework for Elasticsearch data.
- Alerting Tools - Framework for alerting on anomalies in Elasticsearch data.
