ElastAlert Restart Behaviour

[GitUseDeveloper]

I'm using ElastAlert2==2.23.0 version for long time. I'm using certain rules and now I want to change some settings in global config.yaml file and in my custom alerter. If I change the settings and restart, which rule types will affect like lose of tracing past things it stored in indices.

ElastAlert2 is running as systemd service.

[jertel]

The reason it stores tracking/failure/alerting data in the indices is specifically to support restart scenarios. Some rule types do store sliding window data in memory in order to detect accumulated metric anomalies. Restarting ElastAlert 2 would cause those rule types to look back in time to rebuild it's memory. Consequently, your buffer_time setting plays a part with this and should be configured such that it can provide sufficient coverage for this scenario.

[GitUseDeveloper]

That's make sense. Say if rule timeframe is equal to 25 minutes, buffer_time is globally set to 15 minutes in config.yaml. And I'm doing a restart now. Is this buffer_time setting is fine or I need to increase to cover the rule timeframe. Why I'm asking this because each rule definition is different in my environment.

[jertel]

It depends on the rule type. Generally I would probably have buffer_time >= timeframe. Ex: Perhaps you might want buffer_time to be 2 * timeframe for spike rules since it needs to establish a baseline before it can know that an alert condition has occurred.