elastalert

Yo HN! I've followed https://github.com/Yelp/elastalert which was archived and then forked by https://github.com/jertel/elastalert2 for quite a while, and I'm pretty ambiguous about it. On one hand, it looks like these projects got some good traction, but on the other hand, they feel pretty abandoned these days. I've also tried to reach out to the maintainers and am still waiting for an answer. Anyway - if you use any of these projects, I'll be more than happy to talk (just drop a comment or send an email to shahar@keephq.dev) The context is, I'm building Keep (https://github.com/keephq/keep), and I thought these projects could work pretty cool together. So, I'm trying to understand if they are still being used.

> SIEM detection rules ... on our roadmap The current solution in this space, that actually works really well at scale, is ElastAlert[0]. The problem is that ElastAlert is kind of a mess to work with. Lots of documentation, but you need to get into the weeds with it to figure out how it really functions. Once you get it going it's a great tool. Scaling it out (we run hundreds of rules pretty frequently - upwards of 15 times an hour) is just standing up more instances with their own separate rules. [0] https://github.com/Yelp/elastalert

As someone who is involved in the ecosystem and maintains some open-source projects based on ElasticSearch, I am similarly curious about the move to not build upon existing projects (there could be a good reason, but haven't heard it yet). Why wasn't ElastAlert used / built upon for alerting? https://github.com/yelp/elastalert Or why wasn't ElasticSearch SQL used / built upon for SQL? https://github.com/NLPchina/elasticsearch-sql Or why wasn't SearchGuard used / built upon for Security? https://github.com/floragunncom/search-guard All of them have Apache 2.0 license.

This is a good project to happen, and kudos to AWS for doing this! However, like some in the thread, I suspect AWS has been building this for a while for their own product and Elastic's license change may have influenced the decision to open-source. Getting a good out-of-the-box granular security has been a long overdue pain point with ElasticSearch, there have been good alternatives for the other problems it is replicating. 1.) ElastAlert - https://github.com/yelp/elastalert for alerting, 2.) ElasticSearch SQL - https://github.com/NLPchina/elasticsearch-sql for writing SQL queries. Would very much like to hear from OP why these weren't contributed to instead of creating another alternative. We've been working on a similar project in Golang and now well may be as good a day to open-source and put it out there: https://github.com/appbasei

We used elastalert on a project and it did the trick: https://github.com/Yelp/elastalert