Published on

Installing Elastalert for Elasticsearch on Amazon Linux


Elastalert, a service for Alerting with Elasticsearch:

Setting up Elastalert

We will setup Elastalert for Elasticsearch on Amazon Linux which is a RHEL Based Distribution.

Switch to the root user:

$ sudo su

Install the dependencies as the root user:

yum update -y
yum install git python-devel lib-devel libevent-devel bzip2-devel openssl-devel ncurses-devel zlib zlib-devel xz-devel gcc -y
yum install python-setuptools -y
easy_install pip

Switch back to the normal user:


Then continue to install the pip packages:

pip install virtualenv
virtualenv .venv
source .venv/bin/activate
pip install pip --upgrade
pip install setuptools --upgrade

Clone Elastalert Repository and Install Dependencies:

cd /opt/
git clone
cd elastalert/
pip install -r requirements.txt


cp config.yaml.example config.yaml
vim config.yaml
vim example_rules/example_frequency.yaml

After opening the config, populate the configuration where needed.

Installation of elastalert:

python install
# elastalert-create-index

Running elastalert:

python -m elastalert.elastalert --verbose --rule example_frequency.yaml
# INFO:elastalert:Starting up

Systemd Unit File:

# executed after this

Environment="SOME_KEY_1=value" "SOME_KEY_2=value2"
# restart on unexpected exits
# first argument must be an absolute path, rest are arguments to it
ExecStart=/usr/bin/python -m elastalert.elastalert --verbose --rule example_frequency.yaml
# startup/shutdown grace period

# executed before this
# Thanks:

Reload, enable and start:

systemctl daemon-reload
systemctl enable elastalert.service
systemctl start elastalert.service

Thank You

Thanks for reading, feel free to check out my website, feel free to subscribe to my newsletter or follow me at @ruanbekker on Twitter.