How to get power automate alerts working (helm 2.20.0)

[SidAtQuanos]

Hi there,

we run elastalert2 in a kubernes cluster, using the helm charts. Priorly we ran 2.18.0, and updated for having support for power automate to 2.20.0.

However my attempts fail majorly, with error that ms_power_automate was not a supported alert.

Config (simplified)

---
name: alerting-core
type: any
index: alerting
filter:
- query:
    query_string:
      query: "type: core"
alert:
  - "ms_power_automate"
ms_power_automate_teams_card_width_full: True
ms_power_automate_webhook_url: "<url>"
ms_power_automate_alert_facts:
- name: Cluster
  value: facts.cluster
- name: kibana query
  value: facts.discover-query
- name: alert query
  value: facts.alert-query

Error

Reading Elastic 8 index mappings:
Reading index mapping 'es_mappings/8/silence.json'
Reading index mapping 'es_mappings/8/elastalert_status.json'
Reading index mapping 'es_mappings/8/elastalert.json'
Reading index mapping 'es_mappings/8/past_elastalert.json'
Reading index mapping 'es_mappings/8/elastalert_error.json'
Index elastalert already exists. Skipping index creation.
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/elastalert/util.py", line 29, in get_module
    module_path, module_class = module_name.rsplit('.', 1)
    ^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: not enough values to unpack (expected 2, got 1)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 545, in load_alerts
    alert_field = [create_alert(a, b) for a, b in alert_field]
                   ^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 529, in create_alert
    alert_class = self.alerts_mapping.get(alert) or get_module(alert)
                                                    ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/util.py", line 33, in get_module
    raise EAException("Could not import module %s: %s" % (module_name, e)).with_traceback(sys.exc_info()[2])
  File "/usr/local/lib/python3.12/site-packages/elastalert/util.py", line 29, in get_module
    module_path, module_class = module_name.rsplit('.', 1)
    ^^^^^^^^^^^^^^^^^^^^^^^^^
elastalert.util.EAException: Could not import module ms_power_automate: not enough values to unpack (expected 2, got 1)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 172, in load
    rule = self.load_configuration(rule_file, conf, args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 239, in load_configuration
    self.load_modules(rule, args)
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 511, in load_modules
    rule['alert'] = self.load_alerts(rule, alert_field=rule['alert'])
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 548, in load_alerts
    raise EAException('Error initiating alert %s: %s' % (rule['alert'], e)).with_traceback(sys.exc_info()[2])
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 545, in load_alerts
    alert_field = [create_alert(a, b) for a, b in alert_field]
                   ^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 529, in create_alert
    alert_class = self.alerts_mapping.get(alert) or get_module(alert)
                                                    ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/util.py", line 33, in get_module
    raise EAException("Could not import module %s: %s" % (module_name, e)).with_traceback(sys.exc_info()[2])
  File "/usr/local/lib/python3.12/site-packages/elastalert/util.py", line 29, in get_module
    module_path, module_class = module_name.rsplit('.', 1)
    ^^^^^^^^^^^^^^^^^^^^^^^^^
elastalert.util.EAException: Error initiating alert ['ms_power_automate']: Could not import module ms_power_automate: not enough values to unpack (expected 2, got 1)
	During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/elastalert", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/elastalert.py", line 1916, in main
    client = ElastAlerter(args)
             ^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/elastalert.py", line 128, in __init__
    self.rules = self.rules_loader.load(self.conf, self.args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/elastalert/loaders.py", line 184, in load
    raise EAException('Error loading file %s: %s' % (rule_file, e))
elastalert.util.EAException: Error loading file /opt/elastalert/rules/alerting-core.yaml: Error initiating alert ['ms_power_automate']: Could not import module ms_power_automate: not enough values to unpack (expected 2, got 1)				

I'm happy for any hint on what I do wrong. Funny enough, it should not even get into the get_module code ...

[jertel]

I suspect you're still running 2.18.0.

[SidAtQuanos]

That could explain the behaviour.
Though I would assume that

helm repo add elastalert2 https://jertel.github.io/elastalert2/
envsubst < elastalert-2-config.yml | helm upgrade  --install --version="2.20.0" elastalert2  elastalert2/elastalert2 --namespace $KUBE_NAMESPACE -f -

would actually do the trick to update the version to 2.20.0. And in openlens what i can see is
helm.sh/chart=elastalert2-2.20.0
as a label.

And I would think that if openlens shows the label for the pod it should be 2.20.0. Do you have an idea on how to further validate the version or force an update (if it really did not upgrade)?

Edit: Just checked the config files again, after researching for anything starting with 2. ... and found that there was a image tag configured, still pointing to 2.16.0 (while helm was already 2.18.0).

I will try to update the tag to 2.20.0 and retry. Though I wonder why the tag is specified in our config as I'd assume that it is part of the helm chart

[jertel]

It is part of the helm chart. You'd need to track down how that got into your config overrides.