Search code examples
elastalert

Query a specific time-range and alert at specific time of the day

I need to run a rule at 2 am, querying logs from 0 to 2 am, and alert if matches are found.

So far all the rules I created are frequency rules, but I don't know how to achieve the specific time range for the query, and a specific time for the alert, can someone please help?

(I guess the ANY type could let me add my time range as part of the filter....but then how can I run the rule at 2 am every day?)

Solution

  • The now is take the time of the server.

    filter:
 - range:
   "@timestamp":
      "from": "now-2h"
       "to": "now"