Is there any way to get the number of hits that causes alert to be sent

[kw-artem]

Hello!

I have the following rule config:

name: test-NullPointerException
type: frequency
index: app-cm-java-testee
run_every:
  minutes: 5
num_events: 30
timeframe:
  minutes: 5
query_delay:
  minutes: 1
use_count_query: true
attach_related: false
filter:
  - query:
      query_string:
        query: 'trace: "java.lang.NullPointerException"'
  - query:
      query_string:
        query: 'level.keyword: "ERROR"'

alert:
  - alertmanager
alertmanager_hosts:
  - "http://docker01.local:9093"
alertmanager_labels:
  source: "elastalert"
  notification: "TEST"
  severity: "high"
alertmanager_alert_text_labelname: description
alertmanager_alert_subject_labelname: summary

alert_text_type: alert_text_jinja
alert_text: |
  Erros NullPointerException were found in index app-cm-java-testee. Current number:  {{num_hits}}

Sometimes, when an alert fires, we see something confusing: the "current number" in the alert text is less than the num_events: 30 specified in the rule settings.
Based on the ElastAlert logs, we believe this happens because ElastAlert queries every 5 minutes (as per run_every). For example, if 30 hits are spread over two 5-minute buckets (e.g., 25 hits between 10:00–10:04 and the remaining 5 hits between 10:05–10:09), the alert fires during the second bucket but shows only "5 hits" in the text ("Errors NullPointerException were found... Current number: 5"). We found in the discussions that using of {{num_hits}} in alert text is not recommend. But it seems ElastAlert correctly tracks the "cumulative hits" to trigger the alert, but only displays the count from the last bucket. Is there a way to include the total (cumulative) hit count in the alert text?
Thanks in advance!

[jertel]

I suspect you will need to submit a PR to insert that count into the event so that it's available to alerts. I just glanced at the code and it looks like you could do this in FrequencyRule::check_for_match(). Ex:

event['cumulative_event_count'] = self.occurrences[key].count()

If you proceed and would like to make a PR to the project, please follow the CONTRIBUTING guidelines

[kw-artem]

Ok, thanks a lot!