Changing default Index in Elastalert rules generated by playbook #8467
-
|
I want to change the default index in elastalert rules generated by playbook to something different. Currently it will always use :so- as the default index. Where to change or add other indices so that the elastalert rules generated will use different indices. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
This is not currently possible, but we are looking at a few different ways to allow this to be customized. |
Beta Was this translation helpful? Give feedback.
-
|
Has this been done in the meanwhile? I would love to create Sigma rules that query the elastalert index :elastalert_status instead of the default SO index, |
Beta Was this translation helpful? Give feedback.
This is not currently possible, but we are looking at a few different ways to allow this to be customized.