Alert only during specific period of the day

[pradeepgadkari]

We have an application which writes log only during specific time in a day. Below is my rule but we still get an alert at 8:00 German time(6:00 UTC) for number of logs not meeting threshold(The query is run within the limit_execution time but the condition of the query is from 18:00-6:00 when there are no logs,hence the alert )

# Type of alert.
type: flatline

# Alert when this many documents matching the query occur within a timeframe
threshold: 1
use_terms: true

# num_events must occur within this amount of time to trigger an alert
timeframe:
  minutes: 10
realert:
  minutes: 30

exponential_realert:
  hours: 2

limit_execution: "* 6-18 * * *"

# 24H mode and UTC time
start_time: "6:00"
end_time: "18:00"
# Drop match and cancel alert if (inside/outside) range
drop_if: "outside"

Is the rule correct or do I need to make any changes?
p.s: Running elastalert on docker

[nsano-rururu]

I don't think drop_if are implemented, where did you get the information?

[nsano-rururu]

I don't think limit_execution will throw out alerts outside the specified time

[pradeepgadkari]

Yes, I used this as a reference

[pradeepgadkari]

limit execution does not send alert outside of specified time but I face issue similar to this #160
Is there any other way to tackle this issue?

[nsano-rururu]

I'm sorry. I do not know.

[nsano-rururu]

As far as I know, it shouldn't be.

[nsano-rururu]

Reference information. elastalert_hour_range is included in the fork of elastalert-server. It can be set on the praeco web screen.

Time window feature #333
added hour_range_enhancement in order to use time window feature #6

praecoapp/praeco
https://hub.docker.com/r/praecoapp/praeco
praecoapp/elastalert-server
https://hub.docker.com/r/praecoapp/elastalert-server