elastalert rules don't loaded

[elktty]

Hello!

I installed elk stack and elastalret2 on ubuntu 21.04 and faced the following problem.
When I run the command "elastalert-test-rule --config config.yaml rules/example_frequency.yaml" I get a response:

            To send them but remain verbose, use --verbose instead.
Didn't get any results.
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
                To send them but remain verbose, use --verbose instead.
1 rules loaded
INFO:apscheduler.scheduler:Adding job tentatively -- it will be properly scheduled when the scheduler starts
INFO:elastalert:Queried rule email_rule from 2021-08-27 15:53 MSK to 2021-08-27 16:38 MSK: 0 / 0 hits
WARNING:elasticsearch:DELETE http://localhost:9200/_search/scroll [status:404 request:0.163s]
INFO:elastalert:Queried rule email_rule from 2021-08-27 16:38 MSK to 2021-08-27 16:53 MSK: 0 / 0 hits
WARNING:elasticsearch:DELETE http://localhost:9200/_search/scroll [status:404 request:0.005s]
WARNING:elasticsearch:DE
Would have written the following documents to writeback index (default is elastalert_status):

elastalert_status - {'rule_name': 'email_rule', 'endtime': datetime.datetime(2021, 8, 27, 13, 53, 36, 308361, tzinfo=tzutc()), 'starttime': datetime.datetime(2021, 8, 27, 12, 53, 0, 308361, tzinfo=tzutc()), 'matches': 0, 'hits': 0, '@timestamp': datetime.datetime(2021, 8, 27, 13, 53, 36, 523139, tzinfo=tzutc()), 'time_taken': 0.1792316436767578}

but when I run the command "sudo python3 -m elastalert.elastalert --verbose --rule /rules/example_frequency.yaml --es_debug_trace/opt/runtime.log" the rule fails.

0 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999893 seconds

The debug file shows that the time is 3 hours behind:

curl -H 'Content-Type: application/json' -XGET 'http://localhost:9200/elastalert_status/_search?pretty&size=1000' -d '{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "alert_time": {
            "from": "2021-08-25T13:58:05.405753Z",
            "to": "2021-08-27T13:58:05.405804Z"
          }
        }
      },
      "must": {
        "query_string": {
          "query": "!_exists_:aggregate_id AND alert_sent:false"
        }
      }
    }
  },
  "sort": {
    "alert_time": {
      "order": "asc"
    }
  }
}'

According to my guesses, because of this, the rule does not work, but I cannot figure out how to solve this problem?
I attach the configuration file rules/example_frequency.yaml

name: email_rule

type: frequency

index: log-*

num_events: 3

timeframe:
  hours: 1

filter:
- term:
    message: "error"

alert:
- "email"

email:
- "elk@alert.ru"
smtp_host: "192.168.168.168"
smtp_port: 25
smtp_ssl: false
from_addr: "elastalert@alert"
smtp_auth_file: '/usr/local/etc/elastalert2/smtp_auth.yaml'

[jertel]

It's difficult to read your logs and configs since you didn't format it with markdown syntax. Surround all log and config blocks with triple back ticks.

I'm also not sure what the symptom is you're trying to convey. The "0 rules loaded" is something that would prevent ElastAlert from working, so if that's what you need help with I suggest checking where you stored your rules. The documentation covers this.

[nsano-rururu]

Only one rule can be executed with --rule. It still needs to be in the rules folder. Example: -rule this_rule.yaml

You can use --config to specify the location of the configuration. By default, config.yaml is searched in the current directory.

[nsano-rururu]

When a rule gets disabled it shows in logs like this:

Disabled rules are: ['myrule']

[elktty]

Perhaps you did not understand me, I have a question: why do I get different results when executing commands referring to the same rule? When testing my rule with the command I get "1 rules loaded" and when I run elastalert I get "0 rules loaded"

[jertel]

The first (successful) command line references a relative rules/ path, however the second (failing) command line is referencing an absolute /rules/ path.

elastalert-test-rule --config config.yaml rules/example_frequency.yaml

vs.

sudo python3 -m elastalert.elastalert --verbose --rule /rules/example_frequency.yaml --es_debug_trace/opt/runtime.log

Since you're using the --rule parameter, you don't specify a path. You instead specify the rule filename itself, and your config must have the correct path set for the rules_folder parameter . @nsano-rururu already mentioned this 2 hours ago:

Only one rule can be executed with --rule. It still needs to be in the rules folder. Example: -rule this_rule.yaml

You can use --config to specify the location of the configuration. By default, config.yaml is searched in the current directory.

[elktty]

I didn't see it, got it, thanks