Allow multiple rules to take effect in one index at the same time

[duorouCat]

When I use the frequency rule to trigger an alarm, the event field is also included in the blacklist rule, but I only get one alarm message. How do I make both alarms take effect
The following two alarm rules are valid
frequency_rule1: |-
---
name: frequency_rule1
type: frequency
index: ***
attach_related: true
#use_count_query: true
num_events: 5
timeframe:
minutes: 1
filter:
- query:
query_string:
query: "op.keyword:\[DEL\]"
- query:
query_string:
query: "-username.keyword:SYSDBA"
- query:
query_string:
query: "-msg.keyword:IDENTIFIED"
alert:
- post2:
http_post2_url: "http://1*.*.*.*:*/v1"
http_post2_payload: |
{
"ruleName": "frequency_rule1",
"index": "sqllog-dm82386545613861",
"agent.hostname": "{{ agent.hostname }}",
"timestamp": "{{ _data['@timestamp'] }}",
"numMatches": "{{ num_matches }}",
"numHits": "{{ num_hits }}",
"description": "operation {{ op }} trigger too many time",
"level": "warning",
"op": "{{ op }}",
"sql": "{{ msg }}",
"opAgent": "{{ op_agent }}"
}
http_post2_raw_fields:
relatedEvents: related_events
blacklist_rule1: |-
---
name: blacklist_rule1
type: blacklist
index: ***
compare_key:
- "op_agent"
blacklist:
- "driver"
filter:
- query:
query_string:
query: "-username.keyword:SYSDBA"
- query:
query_string:
query: "-msg:IDENTIFIED"
alert:
- post2:
http_post2_url: "http://...:*/v1"
http_post2_payload: |
{
"timestamp": "{{ _data['@timestamp'] }}",
"description": "{{ op }} or {{ op_agent }} trigger blacklist",
"op": "{{ op }}",
"sql": "{{ msg }}",
"opAgent": "{{ op_agent }}"
}
Also, how do i add or modify rules in elasticalert instead of reinstalling them after modifying the configuration file

[jertel]

I recommend disabling the working frequency rule and focus on getting the blacklist rule to work first. Then re-enable both.

I don't understand what you mean by "reinstalling them after modifying". Saving a rule config file automatically causes the rule to reload in ElastAlert 2.

[duorouCat]

Thank you very much, it is successful, I re-installed and enabled two rules at the same time, can be effective, I don't know what happened before. To answer your question, I didn't tell you all before. I have launched elastalert in kubernetes as a microservice. If I want to add rules, I need to modify confimap, modify deployment volumes and restart pod before adding corresponding configuration files in the Rules folder. Is there a more convenient way

[duorouCat]

The same thing happens again, after changing the frequency rule to usercountquery, the blacklist triggers but the frequency does not trigger. Maybe a reboot is required for the changes to all take effect? Is this a bug?

[jertel]

If a rule file has a problem or typo and it cannot be parsed correctly then ElastAlert 2 will automatically disable the rule. Check your ElastAlert 2 log; it tells you what's going on.

[duorouCat]

Got it. Thank you