The rules matched, but for some reason they were silenced

[wangchao732]

INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
To send them but remain verbose, use --verbose instead.
INFO:elastalert:Note: --debug and --verbose flags are set. --debug takes precedent.
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
To send them but remain verbose, use --verbose instead.
INFO:elastalert:1 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 179.999932 seconds
INFO:elastalert:Queried rule Prod Rule from 2024-07-03 09:44 CST to 2024-07-03 09:55 CST: 7 / 7 hits
INFO:elastalert:Skipping writing to ES: {'exponent': 0, 'rule_name': 'Prod Rule', '@timestamp': '2024-07-03T01:55:01.913510Z', 'until': '2024-07-03T02:55:01.913494Z'}
INFO:elastalert:Alert for Prod Rule at 2024-07-03T01:46:27.992Z:
INFO:elastalert:Prod Rule

@timestamp: 2024-07-03T01:46:27.992Z
@Version: 1
_id: f6JFdpABVEXVlDRlp-VL
_index: k8slog-2024.07.03
fields: {
"namespace": "dapr-application",
"source": "k8slog"
}
host: {
"name": "xxx "
}
log: {
"file": {
"path": "/var/log/containers/iot-data-transfer-consumer-5f6b6f78dd-knlbd_dapr-application_iot-data-transfer-consumer-6161781c35975c64e2326deccabd83870319569b7bd9de44f6d81e9d8c8e2d1e.log"
},
"offset": 44427593
}
message: 2024-07-03 09:46:27.992 ERROR 1 --- [adThread-363667] com.taosdata.jdbc.ws.WSClient : code : 1000 , reason: remote:false wsclient:com.xxx.jdbc.ws.WSClient@2e45bc63
num_hits: 7
num_matches: 7
stream: stdout
tags: [
"_grokparsefailure"
]

INFO:elastalert:Ignoring match for silenced rule Prod Rule
INFO:elastalert:Ignoring match for silenced rule Prod Rule
INFO:elastalert:Ignoring match for silenced rule Prod Rule
INFO:elastalert:Ignoring match for silenced rule Prod Rule
INFO:elastalert:Ignoring match for silenced rule Prod Rule
INFO:elastalert:Ignoring match for silenced rule Prod Rule
INFO:elastalert:Skipping writing to ES: {'rule_name': 'Prod Rule', 'endtime': '2024-07-03T01:55:01.614606Z', 'starttime': '2024-07-03T01:44:52.793036Z', 'matches': 7, 'hits': 7, '@timestamp': '2024-07-03T01:55:01.914528Z', 'time_taken': 0.29988765716552734}
INFO:elastalert:Ran Prod Rule from 2024-07-03 09:44 CST to 2024-07-03 09:55 CST: 7 query hits (0 already seen), 7 matches, 0 alerts sent
INFO:elastalert:Prod Rule range 608

/data/py3/bin/python3 -m elastalert.elastalert --config config.yaml --verbose --debug

--config.yaml
rules_folder: rules/
run_every:
minutes: 3
buffer_time:
minutes: 15
es_host: xxx
es_port: 9200
es_username: elastic
es_password: xxx
use_ssl: true
verify_certs: True
server.ssl.enabled: true
elasticsearch.ssl.certificateAuthorities: [ "xxx" ]
ca_certs: xxx
client_cert: /xxx
client_key: xxx
writeback_index: elastalert_status
alert:

• "dingtalk"
  dingtalk_access_token: "xxx"
  dingtalk_msgtype: "text"
  alert_time_limit:
  days: 2

-- rule

name: Prod Rule
type: any
index: xx*
num_events: 1
timeframe:
minutes: 5
filter:

• bool:
  must: [{"match": {"fields.namespace": "xxx" }},{"match": { "message": "error" }}]
  must_not: [ {"match": {"message": "WARN"}},{"match": {"message": "DEBUG"}},{"match": {"message": "INFO"}} ]
  realert:
  hours: 1
  alert:
• "dingtalk"
  dingtalk:
• 'logger'

[wangchao732]

py3/bin/elastalert-test-rule rules/prod.yaml --config config.yaml --alert

The message was successfully received.

[wangchao732]

It looks like the whole rule has been silenced.

[jertel]

If you don't want it silenced, why do you specify realert of 1 hour?

Also, please read #11 and format your messages appropriately. It's difficult to read them without proper formatting.