diff --git a/CHANGELOG.md b/CHANGELOG.md index df5b49e4..d34baf07 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ - [Docs] Mention the two available Spike-rule metrics that are add into the match record - [#1542](https://github.com/jertel/elastalert2/pull/1542) - @ulmako - [OpsGenie] Corrected spelling of the `opsgenie_default_receipients` configuration option to `opsgenie_default_recipients`. Both variations will continue to work and a warning message will notify affected users. [#1539](https://github.com/jertel/elastalert2/pull/1539) - @lstyles - [OpsGenie] Prevent templated `opsgenie_teams` and `opsgenie_recipients` from being overwritten with evaluated values first time an alert is sent. [#1540](https://github.com/jertel/elastalert2/issues/1540) [#1539](https://github.com/jertel/elastalert2/pull/1539) - @lstyles +- [Docs] Add missing documentation of the timestamp_field option - [#1544](https://github.com/jertel/elastalert2/pull/1544) - @apollolv # 2.20.0 diff --git a/docs/source/ruletypes.rst b/docs/source/ruletypes.rst index 8b57fe1e..890fe82c 100644 --- a/docs/source/ruletypes.rst +++ b/docs/source/ruletypes.rst @@ -142,6 +142,8 @@ Rule Configuration Cheat Sheet +--------------------------------------------------------------+ + | ``buffer_time`` (time, default from config.yaml) | | +--------------------------------------------------------------+ | +| ``timestamp_field`` (string, default "@timestamp") | | ++--------------------------------------------------------------+ | | ``timestamp_type`` (string, default iso) | | +--------------------------------------------------------------+ | | ``timestamp_format`` (string, default "%Y-%m-%dT%H:%M:%SZ") | | @@ -971,6 +973,14 @@ summary_suffix ``summary_suffix``: Specify a suffix string, which will be added after the aggregation summary table. This string is currently not subject to any formatting. +timestamp_field +^^^^^^^^^^^^^^^ + +``timestamp_field``: Specify the name of the document field containing the timestamp. +By default, the field ``@timestamp`` is used to query Elasticsearch. +If ``timestamp_field`` is set, this date field will be considered whenever querying, filtering and aggregating based on timestamps. +(Optional, string, default @timestamp). + timestamp_type ^^^^^^^^^^^^^^