add buffer_time field in rule creation

[giedriusramas]

💪 Motivation

Add buffer_time field to be editable in rule creation . For example when a add rule for count aggregation is added it is good to have buffer_time editable so we could override default from config.yaml

📖 Reference (optional)

https://elastalert.readthedocs.io/en/latest/running_elastalert.html#creating-a-rule

[nsano-rururu]

If use_count_query or use_terms_query is true, buffter_time is ignored, so it may be necessary to make it unsettable or not output to yaml.

[giedriusramas]

Hey @nsano-rururu thanks for your reply

For example I have rule

alert:
  - "debug"
description: "My custom rule."
filter:
  - query:
      query_string:
        query: "destination.ip:*"
import: "../BaseRule.config"
index: "index-*"
is_enabled: true
match_enhancements: []
max_threshold: 1500000000
metric_agg_key: "destination.bytes"
metric_agg_type: "sum"
name: "my-rule"
query_key:
  - "source.ip"
  - "destination.ip"
realert:
  hours: 8
timestamp_field: "@timestamp"
timestamp_type: "iso"
type: "metric_aggregation"
use_strftime_index: false
buffer_time:
        hours: 8

How could I set buffer_time from praeco gui ?

[nsano-rururu]

@giedriusramas

Currently it is not possible to set buffer_time from the screen.
Would it be OK if we could make it configurable for now?
If so, we will address this in the next version.

[giedriusramas]

@nsano-rururu sure it would be nice to have it configurable, thanks in advance

[nsano-rururu]

@giedriusramas

The next release is scheduled for the end of March. Linenotify will be discontinued, so we will delete the Linenotify settings. We will add them at the same time as the release.

[nsano-rururu]

@giedriusramas

As I am also a co-maintainer of elastalert2, I will also be deleting the alert notifications from elastalert2 to Linenotify.