Elastalert | Yelp
A simple framework for alerting on anomalies, spikes, or other patterns in Elasticsearch data.
What is Elastalert | Yelp?
ElastAlert is an open-source alerting framework that monitors data in Elasticsearch for anomalies, spikes, or other predefined patterns. It queries Elasticsearch periodically, applies rule-based logic to detect matches, and triggers alerts through various integrations like email, Slack, or PagerDuty. It solves the need for proactive monitoring and alerting on log or time-series data visualized in Kibana.
DevOps engineers, SREs, and developers who use Elasticsearch and Kibana for log aggregation or metrics monitoring and need automated alerting on data patterns.
Developers choose ElastAlert for its deep integration with Elasticsearch, flexibility in rule creation, and extensive built-in alerting options. It fills the alerting gap in the ELK stack, offering a modular, configurable solution that works with all Elasticsearch versions.
Overview
Easy & Flexible Alerting With ElasticSearch
Use Cases
Best For
- Alerting on sudden spikes or drops in application error rates
- Monitoring for specific blacklisted IP addresses in security logs
- Detecting when log data stops flowing (flatline scenarios)
- Sending alerts when new, unseen values appear in a field
- Creating periodic aggregated reports of alert occurrences
- Integrating Elasticsearch monitoring with incident response tools like PagerDuty or OpsGenie
Not Ideal For
- Projects requiring actively maintained software with regular security updates
- Teams needing stateful alerting with automatic resolve events
- Environments where real-time alerting with sub-second latency is critical
- Organizations preferring graphical rule builders over YAML configuration files
Pros & Cons
Pros
Supports eight rule types like spike, flatline, and new term, enabling detection of various anomalies in Elasticsearch data, as detailed in the README.
Built-in alerts for over a dozen services including Slack, PagerDuty, and JIRA, facilitating seamless integration with incident response workflows.
Alerts can include direct links to Kibana dashboards, allowing quick investigation and enhancing operational visibility, as mentioned in the features.
Rules are defined via YAML files, providing precise control over queries and thresholds, though it requires manual setup and debugging.
Cons
Officially no longer maintained by Yelp, with users directed to ElastAlert2, posing risks for security vulnerabilities and compatibility issues with newer Elasticsearch versions.
FAQ admits it lacks resolve events or warning thresholds, limiting advanced alerting scenarios like acknowledging and closing incidents automatically.
Large document volumes can slow queries, requiring workarounds like use_count_query that reduce alert precision, as noted in the troubleshooting section.
Rule configuration relies on intricate YAML files, which can be error-prone and difficult to debug without deep Elasticsearch and query syntax knowledge.
Frequently Asked Questions
Related Projects
LoghubA large collection of system log datasets for AI-driven log analytics [ISSRE'23]
Linux auditd Detection RulesetBest Practice Auditd Configuration
MatanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
InnerWardenLocal safety layer for AI agents that use the terminal. Screens risky commands and MCP/tool calls, watches Linux activity with eBPF, blocks dangerous behavior, and keeps audit trails local. Open source, self-hosted, dry-run by default.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.