Restrict the content in email notification from ElastAlert - elasticsearch

Currently, I have setup email notification from elastalert. In the email body, it prints all the details of the particular document. I want to restrict it to print only specific term and values from the match.

Please refer to this question here:
Customize the information in an alert received by elastalert plugin for elasticsearch
Also from the ElastAlert documentation, you can use include: field to customize the alert message..

Related

Can I remove the message "This message was sent by Kibana. View rule in Kibana" in kibana alert mail?

I use Elasticsearch and kibana.
I created kibana alert rules and send messages by mails.
However in received mails footer, it has "This message was sent by Kibana. View rule in Kibana" message.
I want to remove this message from mails.
I don't know how solve this problem.

Plugins registered for email entity is not triggered

While i click the email send, i have triggered the plugin with post condition and message as send,setEntity and SetStateDynamicEntity to trigger plugin to update current email sending activity date in the custom field as last activity. While i send normal mail it triggers and update the field, if i send with an attachment in email this plugin not getting triggered. even though i changed the steps from post to Pre-condition it not working. Sometimes it working automatically and sometimes it was not working.
I just tried to recreate your scenario. I added a Plugin Step on "Send" Message of Email Entity. First Image will help you explain this.
Then I create an Email with attachment and send an Email. Second image will help explain this
Now when I profile a same plugin Step, I could see plugin been triggered for Send of Email with Attachment. Image below will show this.
Summary: Yes Plugin is triggered when you attach an attachment with Email and Send it.
Date Sent (schema name: senton) out of the box field already gives you the date and time when email was sent. Or, if you just need the date and time when email was last modified you have the Modified On (schema name: modifiedon) out of the box field.
Also, keep in mind that even if it worked, your logic would not give you the date and time in which the email was sent. It would give you the date and time in which the SendEmailRequest was processed by Dynamics.

Elastalert - Aggregation issue's

I am using Elasticsearch and Elastalert to send simple alerts to my slack channel.
Everything was fine until I started using aggregation
and now it says that alert_sent:false.
I read some questions about aggregation not alerting. Is there a way to do it anyway ?
Cause when im using --save-json FILENAME option all related alerts are there!
But still I need to be able to send that alert, it used to work once i cant remember what i did but i received 1 alert containing 2 events on slack.

Send Email Notifications from Kibana

I have created a Kibana Dashboard which reports the user behaviour. Now based on the dashboard and graphs I want to send a email notification to my team by alerting which user behaviour is not good and which one is performing good.
I know that we can set email alerts on ES log monitoring. Is there any option from kibana dashboard where I can send custom notifications to my team by mentioning the user behaviour.

Receiving emails in Ruby

I'm working with actionmailer. I'm trying to send a mail from email_idA to email_idB, then fetch that email from email_idB, and do some string operations on it to look for specific keywords.
I understood how to send the email. But how do I receive that email from email_idB's inbox? What configurations do I need to do? And how do I extract the email body as plain text?
Did you mean fetch or receive ? Your question uses both these terms and not sure what you mean.
If you just want to do a keyword search on the mails you sent, why not store the outgoing mail in DB and do the search ? (as you said "somehow fetch that email")
To be able to receive emails in your rails app, you would need to implement the receive method in your mailer. Follow this link - link
If you meant fetching emails from your inbox then you have to use POP3. Follow this SO answer - link
Im not sure whats your requirement but I'm sure you will find the above links useful :)

Resources