elastalert-test-rule运行规则生效，而使用python3 -m elastalert.elastalert --config config.yaml --verbose --rule rules/test_frequency.yaml命令不生效

[Zinl]

使用elastalert-test-rule可以用 如上图使用elastalert命令不运行规则 配置文件如下 规则文件


但是使用elastalert命令不执行规则

[nsano-rururu]

What language? .. China?

[Zinl]

这只是我的测试demo，现在问题是，不运行规则，而elastic里面是有匹配的数据的

[Zinl]

无论我怎么修改规则，都是运行如下图，即使规则是错误的

[nsano-rururu]

When a rule gets disabled it shows in logs like this:
So your rule is not in effect.

example

Disabled rules are: ['myrule']

[nsano-rururu]

https://elastalert.readthedocs.io/en/latest/ruletypes.html?highlight=realert#realert

realert
realert: This option allows you to ignore repeating alerts for a period of time. If the rule uses a query_key, this option will be applied on a per key basis. All matches for a given rule, or for matches with the same query_key, will be ignored for the given time. All matches with a missing query_key will be grouped together using a value of _missing. This is applied to the time the alert is sent, not to the time of the event. It defaults to one minute, which means that if ElastAlert is run over a large time period which triggers many matches, only the first alert will be sent by default. If you want every alert, set realert to 0 minutes. (Optional, time, default 1 minute)

[nsano-rururu]

Hack for alerting everytime we see the event - add to your rule file

realert:
  minutes: 0