Updating IRIS Alerter to use ElastAlert Alerter defaults
Description
Currently the IRIS alert uses rule supplied values for the description and simply uses the rule title for the alert title. This significantly reduces the ability to dynamically create/repurpose alerts as the rule creator must tailor each individual alert with a custom description. Additionally this description field as it stands does not resolve any variable or template fields resulting in a static description for all alerts.
This PR aims to resolve this by using the built in create_alert_body() and create_title() functions within the Alerter class.
As this is possibly a breaking change I'm opening this PR as a draft for discussion.
Checklist
- [x] I have reviewed the contributing guidelines.
- [ ] I have included unit tests for my changes or additions.
- [ ] I have successfully run
make test-dockerwith my changes. - [ ] I have manually tested all relevant modes of the change in this PR.
- [ ] I have updated the documentation.
- [ ] I have updated the changelog.
Questions or Comments
Do not merge this PR until discussed! :)
Hey @malinkinsa - I'm just pinging you to see if you have any feedback for the reasoning behind statically setting the Alert Description and Alert Title.
This PR aims to standardize the title and description using the built in functions from ElastAlert, but I think it might be a possible breaking change within the IRIS alert functionality?
Hello, @bvirgilioamnh I have no objections whatsoever.
Will you please move the changelog entry up to the Breaking changes section? The PR shouldn't "break" most users, but it's possible someone could have some script programmatically checking an alert email or message for a specific string, and this change could impact that. So better to be cautious.