How does elasticalert send out the alert of post as soon as the match arrives at the data?

1. It is already configured, and match is also displayed in debug, but alert is not sent. The configuration file is as follows:
rule configuration:
name: ossec_rule
type: any
index: logstash-ossec-*
filter:

  • term:
    type: "ossec"

alert:

  • "post"

http_post_url: "http://.../"

config.yaml configuration:
rules_folder: ossec_rules
run_every:
seconds: 1
buffer_time:
seconds: 1
es_host: 127.0.0.1
es_port: 9200
writeback_index: elastalert_status
alert_time_limit:
days: 1
solution is really urgent, thank you all.

Mar.28,2021

is there no alarm at all, or is there any, or is there any? Is the limit on the number of messages sent per minute configured?

Menu