Query a specific time-range and alert at specific time of the day

Question

I need to run a rule at 2 am, querying logs from 0 to 2 am, and alert if matches are found.

So far all the rules I created are frequency rules, but I don't know how to achieve the specific time range for the query, and a specific time for the alert, can someone please help?

(I guess the ANY type could let me add my time range as part of the filter....but then how can I run the rule at 2 am every day?)

score 0 · Answer 1 · edited Sep 17 '18 at 08:42

0

In UTC:

filter:
  range:
    "@timestamp":
      gte: "now/d+0h"
      lt: "now/d+2h"

edited Sep 17 '18 at 08:42

Unheilig

16,196
193
68
98

answered Sep 17 '18 at 08:38

albert alvarez bruned

1

You forget the - one the range. The correct is - range: – pioupiou Sep 05 '19 at 14:26

score 0 · Accepted Answer · answered Sep 05 '19 at 12:59

0

The now is take the time of the server.

filter:
 - range:
   "@timestamp":
      "from": "now-2h"
       "to": "now"

answered Sep 05 '19 at 12:59

pioupiou

836
2
14
29

score 0 · Answer 3 · answered Feb 08 '23 at 14:56

if you want your alert to be effective for specific hours only, you can create an enhancement that drop the alert if the current time doesnt match your needs check https://elastalert.readthedocs.io/en/latest/recipes/adding_enhancements.html

regards

Query a specific time-range and alert at specific time of the day

3 Answers3