“resolve” event alert subject & alert text arguments.

[zayalaksme]

Below is the docuement generated in elastalert index generated by the rule UP service rule (resolve rule for down service rule). In this UP service document i didnf found any fields regarding service/client information like location, IP, Port etc which are found in Down service docuement. How do I pass the required fields to UP service docuemnt/rule later to get those details in Resolve/restored mail?

Below image is docuement generated by Service Down rule.

[nsano-rururu]

• Does that mean that the information you want is collected in the elasticsearch index and cannot be obtained?
• I think you should also provide the information of the rule file you created as information.

[nsano-rururu]

You want to add an index item that is generated by elastalert2 and registered as data. There is no such function, so it cannot be done.

[nsano-rururu]

Since it is a specification, there is nothing we can do about it.

[zayalaksme]

Yes i know those fields are missing in the event doc which generated at UP service got hitted. My question is how do we send these these fields which are in DOWN filter to the event doc generated when UP service got hitted.
The UP Service rule provided in the Documenation didnt transfer the required fields to Elastalert index? I need above fileds the UP service rule generated event doc.

[nsano-rururu]

can not. Don't let me say the same thing over and over again.

[zayalaksme]

Sorry I didnt see your last message thats why i sent again.