elastalert-test-rule crashes

[raphsimon]

Hello,

when running elastalert-test-rule in version 2.2.1 I get the error as seen below.

elastalert@99176903a509:/opt/elastalert$ elastalert-test-rule --start 2021-08-30T09:30:00 rules/linux/lnx_base64_decode.rule 
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
            To send them but remain verbose, use --verbose instead.
Didn't get any results.
Traceback (most recent call last):
  File "/usr/local/bin/elastalert-test-rule", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.9/site-packages/elastalert/test_rule.py", line 518, in main
    test_instance.run_rule_test()
  File "/usr/local/lib/python3.9/site-packages/elastalert/test_rule.py", line 508, in run_rule_test
    self.run_elastalert(rule_yaml, conf)
  File "/usr/local/lib/python3.9/site-packages/elastalert/test_rule.py", line 402, in run_elastalert
    conf['run_every'] = endtime - starttime
UnboundLocalError: local variable 'endtime' referenced before assignment

Am I using the binary wrong or is this a bug?

[jertel]

@raphsimon Thanks for raising this issue. I suspect that the recent PR #424 introduced this bug. You stated you are running 2.2.1, but this PR isn't in that version. Can you confirm that you are using the correct Docker image, and not elastalert2:latest?

@thican There appears to be a problem with the PR you submitted last week. If the user doesn't specify a JSON data input then the endtime variable isn't getting set. When I brought up a potential risk like this for starttime (if the user doesn't specify the timerange variable) you mentioned the time would already have been set, via the init() method, however, those are setting class member variables, yet the run_elastalert() method is dealing with local variables. Will you please look into this?

[raphsimon]

Oh pardon me, I am in fact using elastalert2:latest

[jertel]

Thanks for confirming. You can use the latest released version of ElastAlert2 via the jertel/elastalert2:2 tag. It will pick up any new 2.x release without grabbing unreleased code.

[thican]

I acknowledge the issue, I will keep you updated when I find a (correct) way to fix the issue; currently it's a bit odd.

[thican]

Hello,

My apologies, I forgot to update some part of the previous MR.
I think MR #433 will fix this issue; I am unable to test it myself.

Best regards

[heewey]

Hello all,
I have the same issue.

elastalert-test-rule rules/frequency_kibana.yaml
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
            To send them but remain verbose, use --verbose instead.
Didn't get any results.
Traceback (most recent call last):
  File "/usr/local/bin/elastalert-test-rule", line 33, in <module>
    sys.exit(load_entry_point('elastalert2==2.2.1', 'console_scripts', 'elastalert-test-rule')())
  File "/usr/local/lib/python3.6/site-packages/elastalert2-2.2.1-py3.6.egg/elastalert/test_rule.py", line 518, in main
    test_instance.run_rule_test()
  File "/usr/local/lib/python3.6/site-packages/elastalert2-2.2.1-py3.6.egg/elastalert/test_rule.py", line 508, in run_rule_test
    self.run_elastalert(rule_yaml, conf)
  File "/usr/local/lib/python3.6/site-packages/elastalert2-2.2.1-py3.6.egg/elastalert/test_rule.py", line 402, in run_elastalert
    conf['run_every'] = endtime - starttime
UnboundLocalError: local variable 'endtime' referenced before assignment

ElastAlert2 compiled from latest build https://github.com/jertel/elastalert2.git on Centos8 with python3.6.

[thican]

Hello @heewey,
The MR #433 has been merged very recently, did you fetch & pull recently?
Currently on branch master (commit db2de04), the line 402 is different:

conf['run_every'] = self.endtime - self.starttime

Also it looks like you are using code from site-packages, maybe you should try to update your current package in case a new version got release with the last fix.

Best regards,

[heewey]

Yes,

I can confirm that the current version works like a charm.
Thanks for the quick answer and solution.

Regards heewey.