A simple framework for alerting on anomalies, spikes, or other patterns in Elasticsearch data.
ElastAlert is an open-source alerting framework that monitors data in Elasticsearch for anomalies, spikes, or other predefined patterns. It queries Elasticsearch periodically, applies rule-based logic to detect matches, and triggers alerts through various integrations like email, Slack, or PagerDuty. It solves the need for proactive monitoring and alerting on log or time-series data visualized in Kibana.
DevOps engineers, SREs, and developers who use Elasticsearch and Kibana for log aggregation or metrics monitoring and need automated alerting on data patterns.
Developers choose ElastAlert for its deep integration with Elasticsearch, flexibility in rule creation, and extensive built-in alerting options. It fills the alerting gap in the ELK stack, offering a modular, configurable solution that works with all Elasticsearch versions.
Easy & Flexible Alerting With ElasticSearch
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports eight rule types like spike, flatline, and new term, enabling detection of various anomalies in Elasticsearch data, as detailed in the README.
Built-in alerts for over a dozen services including Slack, PagerDuty, and JIRA, facilitating seamless integration with incident response workflows.
Alerts can include direct links to Kibana dashboards, allowing quick investigation and enhancing operational visibility, as mentioned in the features.
Rules are defined via YAML files, providing precise control over queries and thresholds, though it requires manual setup and debugging.
Officially no longer maintained by Yelp, with users directed to ElastAlert2, posing risks for security vulnerabilities and compatibility issues with newer Elasticsearch versions.
FAQ admits it lacks resolve events or warning thresholds, limiting advanced alerting scenarios like acknowledging and closing incidents automatically.
Large document volumes can slow queries, requiring workarounds like use_count_query that reduce alert precision, as noted in the troubleshooting section.
Rule configuration relies on intricate YAML files, which can be error-prone and difficult to debug without deep Elasticsearch and query syntax knowledge.