HTTP POST2 alerter issues with Elasticsearch (Docker) self signed certificate

[litsegaard]

I'm trying to use ElastAlert interactively while writing rules. The container is invoked in the following manner:

docker run --rm -it --net elkprodioc-kursse_elk \ -e NO_PROXY=elasticsearch,x.y.z.a \ -v /home/vmadmin/compose-templates/tls/certs/ca/:/opt/elastalert/certs/ \ -v $(pwd)/config/elastalert.yaml:/opt/elastalert/config.yaml \ -v $(pwd)/rules:/opt/elastalert/rules \ jertel/elastalert2:2.15.0 --start "2024-02-21T12:30:00" --end "2024-02-21T16:05:00" --verbose

In the rule(s) I specify a simple alerter section to test the indexing of alert(s) in ES:

alert: post2 http_post2_url: "https://x.y.z.a:9200/<index name goes here>/_doc" http_post2_all_values: True http_post2_timeout: 10 http_post2_ignore_ssl_errors: True http_post2_ca_certs: True verify_certs: False

In the ElastAlert config file I've specified verify_certs: False which is honored by the ElastAlert/Elasticsearch connection but not by HTTP POST2 alerter, which is a little bit annoying. The error I get is "...'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)')))". I thought the alerter(s) would honor the overall settings used by ElastAlert thus ignoring that the certificate is self signed.

Can I come around this in any way?

[litsegaard]

I decided to solve this by posting to Logstash pipeline instead.