
How to Test ElastAlert Locally Using LocalStack: A Step-by-Step Guide
This blog is focusing on how to test ElastAlert using LocalStack. ElastAlert is framework build using ElasticSearch.
- Python: Download and install Python (3.7 or above) from python.org.
- AWS CLI: Install the AWS CLI to manage LocalStack resources easily. Follow the AWS CLI installation guide.
- Docker: Install Docker, as it is required for running LocalStack.
- Download the LocalStack Desktop app from the LocalStack website.
- Install the app by following the provided instructions for your operating system.
- Open the LocalStack Desktop app and start the LocalStack service. This will create a LocalStack environment where you can run your AWS services locally.
- If you prefer using Docker, open Docker Desktop.
- Navigate to the Extensions section and search for LocalStack.
- Install the LocalStack extension directly from Docker Desktop.
- Once installed, you can start LocalStack by selecting it from the extensions list.
—domain-name
can use any word I just used “testinglocally”aws es create-elasticsearch-domain --domain-name testinglocally --endpoint=http://localhost:4566
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
{
"DomainStatus": {
"DomainId": "000000000000/testinglocally",
"DomainName": "locales",
"ARN": "arn:aws:es:us-east-2:000000000000:domain/testinglocally",
"Created": true,
"Deleted": false,
"Endpoint": "testinglocally.us-east-2.es.localhost.localstack.cloud:4566",
"Processing": true,
"UpgradeProcessing": false,
"ElasticsearchVersion": "7.10",
"ElasticsearchClusterConfig": {
"InstanceType": "m3.medium.elasticsearch",
"InstanceCount": 1,
"DedicatedMasterEnabled": true,
"ZoneAwarenessEnabled": false,
"DedicatedMasterType": "m3.medium.elasticsearch",
"DedicatedMasterCount": 1
}
}
}
aws es describe-elasticsearch-domain --domain-name testinglocally --endpoint-url=http://localhost:4566
cd elastalert2
config.yaml
:cp config.yaml.example config.yaml
example
folder. If you do this, remember to specify the path when running ElastAlert rules. elastalert-test-rule --config <path-to-config-file> example_rules/example_frequency.yaml
python setup.py install
example/rules
folder in the ElastAlert repository. You can either select an existing example rule or create a new one for testing. Here’s an example structure for a new rule:1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
name: login page
include: ["@timestamp", "monitor.name", "monitor.status", "ev.application.name"]
type: frequency
# We want to alert if we have been down for 5 minutes
# Heartbeat runs every 60s, so we need 6 failures in 330s to trigger an alert
# timeframe = (num_events - 1) * 60s + 60s / 2
num_events: 1
timeframe:
minutes: 10
index: heartbeat-*
filter:
- query:
query_string:
query: 'monitor.name: "login page" AND monitor.status: "down"'
alert:
- ms_power_automate
ms_power_automate_webhook_url: "https://webhook.site/e3f965f6-4087-4aad-a1db-7e46db55ae1d"
heartbeat
or filebeat
: You can use http://localhost:4566 or locales.us-east-2.es.localhost.localstack.cloud:4566.curl -X PUT "http://localhost:4566/filebeat-1"
PUT
request to add sample data:date -u
it will display like this Mon Sep 30 11:01:57 UTC 2024
take out of timing and use in below CURL request.1
2
3
4
5
6
7
8
curl -X PUT "http://localhost:4566/filebeat-1/_doc/1" -H 'Content-Type: application/json' -d '{
"message": "Test log entry",
"@timestamp": "2024-09-30T14:40:00Z",
"monitor": {
"name": "Test Monitor",
"status": "down"
}
}'
elastalert-test-rule examples/rules/example_error.yaml --alert --config examples/config.yaml
curl -X DELETE "http://localhost:4566/filebeat-1"
curl -X POST "http://localhost:4566/filebeat-1/_refresh"
curl -X GET "http://localhost:4566/filebeat-1/_search"
curl -X GET "http://localhost:4566/filebeat-1/_search?q=monitor.status:down"
curl -X GET 'http://localhost:4566/_cat/indices?v'
@timestamp
field in your sample data falls within the range of the query in your rule. If your rule looks at data from a specific time range, ensure that your sample data aligns with this range.elastalert-test-rule examples/rules/example_error.yaml --alert --verbose
index_not_found_exception
can be resolved by creating the index first or ensuring the correct configuration file paths.- LocalStack Documentation
- https://docs.localstack.cloud/user-guide/aws/elasticsearch/
- https://hub.docker.com/r/localstack/localstack#installing
- https://docs.aws.amazon.com/cli/latest/reference/es/describe-elasticsearch-domain.html