Search code examples
elasticsearchlogstashalertkibana-5elastalert

custom fields in elastalert index created in elasticsearch

ElastAlert updates metadata related to the rules in the elastalert_status index in the elasticsearch. The fields available in that index have fields like: 

alert_info
alert_time
endtime
exponent
hits
matches
message
rule_type
traceback
until

additionally some fields that store the match_body. but for each sub-fields kibana shows match_body fields All these fields seem to have originated from the query_key but as there is not mapped field for them they are inaccessible in the kibana visualization

(the error: no catched mapping for these fields. Refresh fields' list from the management > Index Patterns page), refreshing which doesn't help. I have tried adding fields that i require with include directive (in the rule file), but no success. Does anybody have any solution for getting specific fields in the elastalert_status index? that can be used in visualization. Haven't tried but giving logstash as output for elastalert will help adding the fields on basis of the content of message but not sure if it may word. anyways it's not best possible solution.

version of ELK stack 5.1.2

Solution

  • changing the code in create_index.py with 'match_body' : {'enabled': False to True.... creates the respective mapping in the elasticsearch elastalert_status index.