doctorkirk/elastalert-ubuntu repository overview

⁠ Disclaimer

Here is the containerized version of the alerting system Elastalert.
This image has been built on top of Ubuntu 20.04, with the steps provided by the Official Elastalert documentation⁠

⁠Quick Start

Pull the image

docker pull doctorkirk/elastalert-ubuntu:0.2.4

Meanwhile i find a way to make ENTRYPONT working properly, here's a way to make the example_rules directory permanent

⁠ Create a dummy Container

mkdir /your/docker/path/elastalert

docker run -dit --name elastalert doctorkirk/elastalert-ubuntu:0.2.4

cd /your/docker/path/elastalert

⁠ Copy the directory outside the container

docker cp elastalert:/elastalert/example_rules .

⁠ Create the config.yaml file*

vi config.yaml

rules_folder: example_rules
run_every:
  minutes: 1
buffer_time:
  minutes: 15
es_host: localhost
es_port: 9200
writeback_index: elastalert_status
writeback_alias: elastalert_alerts
alert_time_limit:
  days: 2

*This is a sample file, customize it accordingly to your needs

⁠ Delete the dummy container

docker rm -f elastalert

⁠Run the final Container

docker run -dit \
--name elastalert \
-v /your/docker/path//elastalert/config.yaml:/elastalert/config.yaml \
-v /your/docker/path//elastalert/example_rules:/elastalert/example_rules \
--restart=unless-stopped \
doctorkirk/elastalert-ubuntu:0.2.4