Alert with limit_execution no longer sending alerts

[roman-tasi]

It was working for about the first day or so (I was getting alerts in my Rocket.Chat implementation), but now it is no longer sending alerts at all. I see no errors in my docker logs, this is all I see:

[root@ELK-Stack elastalert_rules]# docker logs elastalert2 2>&1 | grep "Filesystem"
2024-03-13 00:00:00,007     INFO apscheduler.executors.default Running job "Rule: Filesystem Used Percent Rules File (trigger: interval[0:01:00], next run at: 2024-03-13 00:01:02 UTC)" (scheduled at 2024-03-13 00:00:00+00:00)
2024-03-13 00:00:00,008     INFO           elastalert Pausing Filesystem Used Percent Rules File until next run at 2024-03-13 04:00 UTC
2024-03-13 00:00:00,008     INFO apscheduler.executors.default Job "Rule: Filesystem Used Percent Rules File (trigger: interval[0:01:00], next run at: 2024-03-13 04:00:00 UTC)" executed successfully

This is my limit_execution: 0 */4 * * *

• specifies to run every 4 hours

Once I take the limit_execution off, the alerts send normally. Also I should mention I have a realert period of 5 minutes, not sure if that could be interfering with anything.

Any idea what the issue is?

[jertel]

See the limit_execution docs. Notice how they are using a time range. Your schedule uses instant moments of time rather than a range. It needs to be a range, or window of time, when the rule will be active.