Никита Решетняк

Проблема была в том что правила по типу flatline срабатывают при переходе значения threshold. То есть если на момент добавления или обновления правила elastalert'а количество документов было уже ниже параметра threshold то алерт отправлен не будет.

Рабочий пример ниже

es_host: <ELASTIC HOST>
es_port: 9200
# es_username: elastic
# es_password: changeme

name: ":warning:WARNING : POSTGRES probably unavailable:warning:"
description: "postgres probably unavailable"
severity: "warning"

index: app-prod-metrics*

filter: 
- query:
    query_string:
      query: "postgresql.activity.query: \"SELECT * FROM pg_stat_database\""

type: flatline
threshold: 4
timeframe:
  minutes: 1
realert:
  seconds: 10

query_key: postgresql.activity.query

alert:
- "telegram"
alert_text: "
Too few metrics from\n
*Postgres on Host*   : host name\n
*ElastAlert Node*    : alert host name"
alert_text_type: alert_text_only

telegram_bot_token: <TOKEN>
telegram_room_id: "@<CHAT_ID>"

Рабочий пример

es_host: <ELASTIC IP>
es_port: 9200
# es_username: elastic
# es_password: changeme

name: ":warning:WARNING : Disk Usage Alert:warning:"
description: "running out of free disk space"
severity: "warning"

index: app-prod-metrics*

type: any

realert:
  minutes: 1

filter: 
- query:
    query_string:
      query: "system.filesystem.used.pct:[0.8 TO 0.9] AND system.filesystem.device_name: \"/dev/sda1\""
query_delay:
  minutes: 1
query_key: host
query_key: system.filesystem.used.pct
query_key: system.filesystem.device_name

alert_text_type: alert_text_only
include : ["host","system.filesystem.used.pct","system.filesystem.device_name"]

alert:
- "slack"
#-telegram
alert_text: "
*Used %*        : {0:.2%}\n
*Host*          : {1}\n
*Mount Point*   : {2}\n
*ElastAlert Node*  : elastalert on "
alert_text_type: alert_text_only
alert_text_args: ["system.filesystem.used.pct","host","system.filesystem.device_name"]

slack:
slack_webhook_url: "<SLACK URL>"

# telegram_bot_token: <TOKEN>
# telegram_room_id: "@<ROOM NAME>"

Вопрос снят. Грамматическая ошибка в конфиге