{"action":"created","comment":{"url":"https://api.github.com/repos/Yelp/elastalert/pulls/comments/186256156","pull_request_review_id":117807928,"id":186256156,"diff_hunk":"@@ -0,0 +1,79 @@\n+# Alert when there is a sudden spike in the volume of events\n+\n+# (Optional)\n+# Elasticsearch host\n+# es_host: elasticsearch.example.com\n+\n+# (Optional)\n+# Elasticsearch port\n+# es_port: 14900\n+\n+# (Optional) Connect with SSL to Elasticsearch\n+#use_ssl: True\n+\n+# (Optional) basic-auth username and password for Elasticsearch\n+#es_username: someusername\n+#es_password: somepassword\n+\n+# (Required)\n+# Rule name, must be unique\n+name: Event spike\n+\n+# (Required)\n+# Type of alert.\n+# the spike rule type compares the number of events within two sliding windows to each other\n+type: spike\n+\n+# (Required)\n+# Index to search, wildcard supported\n+index: rpn_module_info*\n+field_value: messages\n+\n+timestamp_type: unix_ms\n+\n+# (Required one of _cur or _ref, spike specific)\n+# The minimum number of events that will trigger an alert\n+# For example, if there are only 2 events between 12:00 and 2:00, and 20 between 2:00 and 4:00\n+# _cur is 2 and _ref is 20, and the alert WILL fire because 20 is greater than threshold_cur\n+threshold_cur: 5\n+#threshold_ref: 5\n+\n+# (Required, spike specific)\n+# The size of the window used to determine average event frequency\n+# We use two sliding windows each of size timeframe\n+# To measure the 'reference' rate and the current rate\n+timeframe:\n+  seconds: 30\n+\n+# (Required, spike specific)\n+# The spike rule matches when the current window contains spike_height times more\n+# events than the reference window\n+spike_height: 1.2\n+\n+# (Required, spike specific)\n+# The direction of the spike\n+# 'up' matches only spikes, 'down' matches only troughs\n+# 'both' matches both spikes and troughs\n+spike_type: \"up\"\n+query_key: module\n+\n+# (Required)\n+# A list of Elasticsearch filters used for find events\n+# These filters are joined with AND and nested in a filtered query\n+# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html\n+filter:\n+- query:\n+    query_string:\n+#      query: \"messages:* AND module: Skeleton\"\n+      query: \"messages:*\"\n+\n+# (Required)\n+# The alert is use when a match is found\n+alert:\n+  - \"stomp\"\n+\n+stomp_hostname: app.rpinum.be","path":"elastalert/example_rules/spiketest.yaml","position":null,"original_position":75,"commit_id":"bb39e02394cca54532176fe355c57d9190798adc","original_commit_id":"28244af4a98026e2b3e59d1a4f073498e1f458d1","user":{"login":"snuids","id":13175107,"avatar_url":"https://avatars1.githubusercontent.com/u/13175107?v=4","gravatar_id":"","url":"https://api.github.com/users/snuids","html_url":"https://github.com/snuids","followers_url":"https://api.github.com/users/snuids/followers","following_url":"https://api.github.com/users/snuids/following{/other_user}","gists_url":"https://api.github.com/users/snuids/gists{/gist_id}","starred_url":"https://api.github.com/users/snuids/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snuids/subscriptions","organizations_url":"https://api.github.com/users/snuids/orgs","repos_url":"https://api.github.com/users/snuids/repos","events_url":"https://api.github.com/users/snuids/events{/privacy}","received_events_url":"https://api.github.com/users/snuids/received_events","type":"User","site_admin":false},"body":"Ooops will change some parameters :-)\r\n","created_at":"2018-05-05T08:14:20Z","updated_at":"2018-05-05T08:14:20Z","html_url":"https://github.com/Yelp/elastalert/pull/1666#discussion_r186256156","pull_request_url":"https://api.github.com/repos/Yelp/elastalert/pulls/1666","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/Yelp/elastalert/pulls/comments/186256156"},"html":{"href":"https://github.com/Yelp/elastalert/pull/1666#discussion_r186256156"},"pull_request":{"href":"https://api.github.com/repos/Yelp/elastalert/pulls/1666"}},"in_reply_to_id":185930302},"pull_request":{"url":"https://api.github.com/repos/Yelp/elastalert/pulls/1666","id":184776384,"html_url":"https://github.com/Yelp/elastalert/pull/1666","diff_url":"https://github.com/Yelp/elastalert/pull/1666.diff","patch_url":"https://github.com/Yelp/elastalert/pull/1666.patch","issue_url":"https://api.github.com/repos/Yelp/elastalert/issues/1666","number":1666,"state":"open","locked":false,"title":"Added the possibility to choose a document field in a spike rule","user":{"login":"snuids","id":13175107,"avatar_url":"https://avatars1.githubusercontent.com/u/13175107?v=4","gravatar_id":"","url":"https://api.github.com/users/snuids","html_url":"https://github.com/snuids","followers_url":"https://api.github.com/users/snuids/followers","following_url":"https://api.github.com/users/snuids/following{/other_user}","gists_url":"https://api.github.com/users/snuids/gists{/gist_id}","starred_url":"https://api.github.com/users/snuids/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snuids/subscriptions","organizations_url":"https://api.github.com/users/snuids/orgs","repos_url":"https://api.github.com/users/snuids/repos","events_url":"https://api.github.com/users/snuids/events{/privacy}","received_events_url":"https://api.github.com/users/snuids/received_events","type":"User","site_admin":false},"body":"@Qmando \r\n\r\nHi,\r\n\r\nI required the possibility to trigger spike rules on a particular field value of the document and not on the count of the documents. As I am lazy, and as I don't want to write a new rule using aggregations, I simply added a few tests in your spike rule code. It is not optimal but it works for me and did not create any regressions (At least for me). If you are interested in this pull request, I can fill the documentation accordingly. \r\n\r\nCheers,\r\n\r\nArnaud\r\n","created_at":"2018-04-28T09:45:30Z","updated_at":"2018-05-05T08:14:20Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0919770122c122dcf95e0e4999aa2375fdb5772b","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/Yelp/elastalert/pulls/1666/commits","review_comments_url":"https://api.github.com/repos/Yelp/elastalert/pulls/1666/comments","review_comment_url":"https://api.github.com/repos/Yelp/elastalert/pulls/comments{/number}","comments_url":"https://api.github.com/repos/Yelp/elastalert/issues/1666/comments","statuses_url":"https://api.github.com/repos/Yelp/elastalert/statuses/bb39e02394cca54532176fe355c57d9190798adc","head":{"label":"snuids:master","ref":"master","sha":"bb39e02394cca54532176fe355c57d9190798adc","user":{"login":"snuids","id":13175107,"avatar_url":"https://avatars1.githubusercontent.com/u/13175107?v=4","gravatar_id":"","url":"https://api.github.com/users/snuids","html_url":"https://github.com/snuids","followers_url":"https://api.github.com/users/snuids/followers","following_url":"https://api.github.com/users/snuids/following{/other_user}","gists_url":"https://api.github.com/users/snuids/gists{/gist_id}","starred_url":"https://api.github.com/users/snuids/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snuids/subscriptions","organizations_url":"https://api.github.com/users/snuids/orgs","repos_url":"https://api.github.com/users/snuids/repos","events_url":"https://api.github.com/users/snuids/events{/privacy}","received_events_url":"https://api.github.com/users/snuids/received_events","type":"User","site_admin":false},"repo":{"id":131395763,"name":"elastalert","full_name":"snuids/elastalert","owner":{"login":"snuids","id":13175107,"avatar_url":"https://avatars1.githubusercontent.com/u/13175107?v=4","gravatar_id":"","url":"https://api.github.com/users/snuids","html_url":"https://github.com/snuids","followers_url":"https://api.github.com/users/snuids/followers","following_url":"https://api.github.com/users/snuids/following{/other_user}","gists_url":"https://api.github.com/users/snuids/gists{/gist_id}","starred_url":"https://api.github.com/users/snuids/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snuids/subscriptions","organizations_url":"https://api.github.com/users/snuids/orgs","repos_url":"https://api.github.com/users/snuids/repos","events_url":"https://api.github.com/users/snuids/events{/privacy}","received_events_url":"https://api.github.com/users/snuids/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/snuids/elastalert","description":"Easy & Flexible Alerting With ElasticSearch","fork":true,"url":"https://api.github.com/repos/snuids/elastalert","forks_url":"https://api.github.com/repos/snuids/elastalert/forks","keys_url":"https://api.github.com/repos/snuids/elastalert/keys{/key_id}","collaborators_url":"https://api.github.com/repos/snuids/elastalert/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/snuids/elastalert/teams","hooks_url":"https://api.github.com/repos/snuids/elastalert/hooks","issue_events_url":"https://api.github.com/repos/snuids/elastalert/issues/events{/number}","events_url":"https://api.github.com/repos/snuids/elastalert/events","assignees_url":"https://api.github.com/repos/snuids/elastalert/assignees{/user}","branches_url":"https://api.github.com/repos/snuids/elastalert/branches{/branch}","tags_url":"https://api.github.com/repos/snuids/elastalert/tags","blobs_url":"https://api.github.com/repos/snuids/elastalert/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/snuids/elastalert/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/snuids/elastalert/git/refs{/sha}","trees_url":"https://api.github.com/repos/snuids/elastalert/git/trees{/sha}","statuses_url":"https://api.github.com/repos/snuids/elastalert/statuses/{sha}","languages_url":"https://api.github.com/repos/snuids/elastalert/languages","stargazers_url":"https://api.github.com/repos/snuids/elastalert/stargazers","contributors_url":"https://api.github.com/repos/snuids/elastalert/contributors","subscribers_url":"https://api.github.com/repos/snuids/elastalert/subscribers","subscription_url":"https://api.github.com/repos/snuids/elastalert/subscription","commits_url":"https://api.github.com/repos/snuids/elastalert/commits{/sha}","git_commits_url":"https://api.github.com/repos/snuids/elastalert/git/commits{/sha}","comments_url":"https://api.github.com/repos/snuids/elastalert/comments{/number}","issue_comment_url":"https://api.github.com/repos/snuids/elastalert/issues/comments{/number}","contents_url":"https://api.github.com/repos/snuids/elastalert/contents/{+path}","compare_url":"https://api.github.com/repos/snuids/elastalert/compare/{base}...{head}","merges_url":"https://api.github.com/repos/snuids/elastalert/merges","archive_url":"https://api.github.com/repos/snuids/elastalert/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/snuids/elastalert/downloads","issues_url":"https://api.github.com/repos/snuids/elastalert/issues{/number}","pulls_url":"https://api.github.com/repos/snuids/elastalert/pulls{/number}","milestones_url":"https://api.github.com/repos/snuids/elastalert/milestones{/number}","notifications_url":"https://api.github.com/repos/snuids/elastalert/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/snuids/elastalert/labels{/name}","releases_url":"https://api.github.com/repos/snuids/elastalert/releases{/id}","deployments_url":"https://api.github.com/repos/snuids/elastalert/deployments","created_at":"2018-04-28T09:36:29Z","updated_at":"2018-05-05T08:13:41Z","pushed_at":"2018-05-05T08:13:39Z","git_url":"git://github.com/snuids/elastalert.git","ssh_url":"git@github.com:snuids/elastalert.git","clone_url":"https://github.com/snuids/elastalert.git","svn_url":"https://github.com/snuids/elastalert","homepage":"https://elastalert.readthedocs.org","size":2615,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"Yelp:master","ref":"master","sha":"035b587947a8f9ad7cd2eb75787ca125824559b0","user":{"login":"Yelp","id":49071,"avatar_url":"https://avatars1.githubusercontent.com/u/49071?v=4","gravatar_id":"","url":"https://api.github.com/users/Yelp","html_url":"https://github.com/Yelp","followers_url":"https://api.github.com/users/Yelp/followers","following_url":"https://api.github.com/users/Yelp/following{/other_user}","gists_url":"https://api.github.com/users/Yelp/gists{/gist_id}","starred_url":"https://api.github.com/users/Yelp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yelp/subscriptions","organizations_url":"https://api.github.com/users/Yelp/orgs","repos_url":"https://api.github.com/users/Yelp/repos","events_url":"https://api.github.com/users/Yelp/events{/privacy}","received_events_url":"https://api.github.com/users/Yelp/received_events","type":"Organization","site_admin":false},"repo":{"id":27091760,"name":"elastalert","full_name":"Yelp/elastalert","owner":{"login":"Yelp","id":49071,"avatar_url":"https://avatars1.githubusercontent.com/u/49071?v=4","gravatar_id":"","url":"https://api.github.com/users/Yelp","html_url":"https://github.com/Yelp","followers_url":"https://api.github.com/users/Yelp/followers","following_url":"https://api.github.com/users/Yelp/following{/other_user}","gists_url":"https://api.github.com/users/Yelp/gists{/gist_id}","starred_url":"https://api.github.com/users/Yelp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yelp/subscriptions","organizations_url":"https://api.github.com/users/Yelp/orgs","repos_url":"https://api.github.com/users/Yelp/repos","events_url":"https://api.github.com/users/Yelp/events{/privacy}","received_events_url":"https://api.github.com/users/Yelp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Yelp/elastalert","description":"Easy & Flexible Alerting With ElasticSearch","fork":false,"url":"https://api.github.com/repos/Yelp/elastalert","forks_url":"https://api.github.com/repos/Yelp/elastalert/forks","keys_url":"https://api.github.com/repos/Yelp/elastalert/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Yelp/elastalert/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Yelp/elastalert/teams","hooks_url":"https://api.github.com/repos/Yelp/elastalert/hooks","issue_events_url":"https://api.github.com/repos/Yelp/elastalert/issues/events{/number}","events_url":"https://api.github.com/repos/Yelp/elastalert/events","assignees_url":"https://api.github.com/repos/Yelp/elastalert/assignees{/user}","branches_url":"https://api.github.com/repos/Yelp/elastalert/branches{/branch}","tags_url":"https://api.github.com/repos/Yelp/elastalert/tags","blobs_url":"https://api.github.com/repos/Yelp/elastalert/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Yelp/elastalert/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Yelp/elastalert/git/refs{/sha}","trees_url":"https://api.github.com/repos/Yelp/elastalert/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Yelp/elastalert/statuses/{sha}","languages_url":"https://api.github.com/repos/Yelp/elastalert/languages","stargazers_url":"https://api.github.com/repos/Yelp/elastalert/stargazers","contributors_url":"https://api.github.com/repos/Yelp/elastalert/contributors","subscribers_url":"https://api.github.com/repos/Yelp/elastalert/subscribers","subscription_url":"https://api.github.com/repos/Yelp/elastalert/subscription","commits_url":"https://api.github.com/repos/Yelp/elastalert/commits{/sha}","git_commits_url":"https://api.github.com/repos/Yelp/elastalert/git/commits{/sha}","comments_url":"https://api.github.com/repos/Yelp/elastalert/comments{/number}","issue_comment_url":"https://api.github.com/repos/Yelp/elastalert/issues/comments{/number}","contents_url":"https://api.github.com/repos/Yelp/elastalert/contents/{+path}","compare_url":"https://api.github.com/repos/Yelp/elastalert/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Yelp/elastalert/merges","archive_url":"https://api.github.com/repos/Yelp/elastalert/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Yelp/elastalert/downloads","issues_url":"https://api.github.com/repos/Yelp/elastalert/issues{/number}","pulls_url":"https://api.github.com/repos/Yelp/elastalert/pulls{/number}","milestones_url":"https://api.github.com/repos/Yelp/elastalert/milestones{/number}","notifications_url":"https://api.github.com/repos/Yelp/elastalert/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Yelp/elastalert/labels{/name}","releases_url":"https://api.github.com/repos/Yelp/elastalert/releases{/id}","deployments_url":"https://api.github.com/repos/Yelp/elastalert/deployments","created_at":"2014-11-24T19:39:19Z","updated_at":"2018-05-05T05:52:59Z","pushed_at":"2018-05-05T08:13:41Z","git_url":"git://github.com/Yelp/elastalert.git","ssh_url":"git@github.com:Yelp/elastalert.git","clone_url":"https://github.com/Yelp/elastalert.git","svn_url":"https://github.com/Yelp/elastalert","homepage":"https://elastalert.readthedocs.org","size":2671,"stargazers_count":4407,"watchers_count":4407,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":920,"mirror_url":null,"archived":false,"open_issues_count":600,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":920,"open_issues":600,"watchers":4407,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/Yelp/elastalert/pulls/1666"},"html":{"href":"https://github.com/Yelp/elastalert/pull/1666"},"issue":{"href":"https://api.github.com/repos/Yelp/elastalert/issues/1666"},"comments":{"href":"https://api.github.com/repos/Yelp/elastalert/issues/1666/comments"},"review_comments":{"href":"https://api.github.com/repos/Yelp/elastalert/pulls/1666/comments"},"review_comment":{"href":"https://api.github.com/repos/Yelp/elastalert/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/Yelp/elastalert/pulls/1666/commits"},"statuses":{"href":"https://api.github.com/repos/Yelp/elastalert/statuses/bb39e02394cca54532176fe355c57d9190798adc"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"snuids"}}