elastalert2 icon indicating copy to clipboard operation
elastalert2 copied to clipboard

Updating IRIS Alerter to use ElastAlert Alerter defaults

Open bvirgilioamnh opened this issue 1 year ago • 1 comments

Description

Currently the IRIS alert uses rule supplied values for the description and simply uses the rule title for the alert title. This significantly reduces the ability to dynamically create/repurpose alerts as the rule creator must tailor each individual alert with a custom description. Additionally this description field as it stands does not resolve any variable or template fields resulting in a static description for all alerts.

This PR aims to resolve this by using the built in create_alert_body() and create_title() functions within the Alerter class.

As this is possibly a breaking change I'm opening this PR as a draft for discussion.

Checklist

  • [x] I have reviewed the contributing guidelines.
  • [ ] I have included unit tests for my changes or additions.
  • [ ] I have successfully run make test-docker with my changes.
  • [ ] I have manually tested all relevant modes of the change in this PR.
  • [ ] I have updated the documentation.
  • [ ] I have updated the changelog.

Questions or Comments

Do not merge this PR until discussed! :)

bvirgilioamnh avatar Sep 09 '24 13:09 bvirgilioamnh

Hey @malinkinsa - I'm just pinging you to see if you have any feedback for the reasoning behind statically setting the Alert Description and Alert Title.

This PR aims to standardize the title and description using the built in functions from ElastAlert, but I think it might be a possible breaking change within the IRIS alert functionality?

bvirgilioamnh avatar Sep 09 '24 13:09 bvirgilioamnh

Hello, @bvirgilioamnh I have no objections whatsoever.

malinkinsa avatar Sep 11 '24 15:09 malinkinsa

Will you please move the changelog entry up to the Breaking changes section? The PR shouldn't "break" most users, but it's possible someone could have some script programmatically checking an alert email or message for a specific string, and this change could impact that. So better to be cautious.

jertel avatar Sep 16 '24 14:09 jertel