How can I configure logging level?

[cagri387]

I want to see some more logs when I run docker logs. I tried to edit corresponding line in DockerFile to run elastalert with --verbose parameter, but it didn't work.

echo "exec elastalert --verbose --config /opt/config/elastalert_config.yaml \"\$@\"" >> /opt/elastalert/run.sh && \

How can I run elastalert with logging level info or even below?

[jertel]

There is no need to modify the Dockerfile. You can add either --debug or --verbose to the end of the docker run ... command line. Below are three scenarios showing the difference in logging behavior:

Running with normal logging:

jertel@y go % docker run -it --rm -v /tmp/ea/config.yaml:/opt/config/elastalert_config.yaml jertel/elastalert-docker
Elastic Version: 7.9.2
Reading Elastic 6 index mappings:
Reading index mapping 'es_mappings/6/silence.json'
Reading index mapping 'es_mappings/6/elastalert_status.json'
Reading index mapping 'es_mappings/6/elastalert.json'
Reading index mapping 'es_mappings/6/past_elastalert.json'
Reading index mapping 'es_mappings/6/elastalert_error.json'
Index elastalert_status already exists. Skipping index creation.
0 rules loaded

Running with verbose logging: (Notice the additional INFO log lines)

jertel@y go % docker run -it --rm -v /tmp/ea/config.yaml:/opt/config/elastalert_config.yaml jertel/elastalert-docker --verbose
Elastic Version: 7.9.2
Reading Elastic 6 index mappings:
Reading index mapping 'es_mappings/6/silence.json'
Reading index mapping 'es_mappings/6/elastalert_status.json'
Reading index mapping 'es_mappings/6/elastalert.json'
Reading index mapping 'es_mappings/6/past_elastalert.json'
Reading index mapping 'es_mappings/6/elastalert_error.json'
Index elastalert_status already exists. Skipping index creation.
0 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999898 seconds

Logging with Debug: (Notice the output that advises DEBUG mode does not actually trigger alerts)

jertel@y go % docker run -it --rm -v /tmp/ea/config.yaml:/opt/config/elastalert_config.yaml jertel/elastalert-docker --debug
Elastic Version: 7.9.2
Reading Elastic 6 index mappings:
Reading index mapping 'es_mappings/6/silence.json'
Reading index mapping 'es_mappings/6/elastalert_status.json'
Reading index mapping 'es_mappings/6/elastalert.json'
Reading index mapping 'es_mappings/6/past_elastalert.json'
Reading index mapping 'es_mappings/6/elastalert_error.json'
Index elastalert_status already exists. Skipping index creation.
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
                To send them but remain verbose, use --verbose instead.
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
            To send them but remain verbose, use --verbose instead.
0 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999902 seconds

You can further tweak logging output via the logging section in the config.yaml file, if needed.

As this is not an actual issue I'm moving this to the Discussions area.

[cagri387]

Thank you so much.