<commit_before>Rule Types and Configuration Options
************************************

Examples of several types of rule configuration can be found in the example_rules folder.

.. _commonconfig:

.. note:: All "time" formats are of the form ``unit: X`` where unit is one of weeks, days, hours, minutes or seconds.
    Such as ``minutes: 15`` or ``hours: 1``.


Rule Configuration Cheat Sheet
==============================


+--------------------------------------------------------------------------+
|              FOR ALL RULES                                               |
+==============================================================+===========+
| ``es_host`` (string)                                         |  Required |
+--------------------------------------------------------------+           |
| ``es_port`` (number)                                         |           |
+--------------------------------------------------------------+           |
| ``index`` (string)                                           |           |
+--------------------------------------------------------------+           |
| ``name`` (string)                                            |           |
+--------------------------------------------------------------+           |
| ``type`` (string)                                            |           |
+--------------------------------------------------------------+           |
| ``alert`` (string or list)                                   |           |
+--------------------------------------------------------------+-----------+
| ``use_strftime_index`` (boolean, default False)              |  Optional |
+--------------------------------------------------------------+           |
| ``use_ssl`` (boolean, default False)                         |           |
+--------------------------------------------------------------+           |
| ``verify_certs`` (boolean, default True)                     |           |
+--------------------------------------------------------------+           |
| ``es_username`` (string, no default)                         |           |
+--------------------------------------------------------------+           |
| ``es_password`` (string, no default)                         |           |
+--------------------------------------------------------------+           |
| ``es_url_prefix`` (string, no default)                       |           |
+--------------------------------------------------------------+           |
| ``es_send_get_body_as`` (string, default "GET")              |           |
+--------------------------------------------------------------+           |
| ``aggregation`` (time, no default)                           |           |
+--------------------------------------------------------------+           |
| ``description`` (string, default empty string)               |           |
+--------------------------------------------------------------+           |
| ``generate_kibana_link`` (boolean, default False)            |           |
+--------------------------------------------------------------+           |
| ``use_kibana_dashboard`` (string, no default)                |           |
+--------------------------------------------------------------+           |
| ``kibana_url`` (string, default from es_host)                |           |
+--------------------------------------------------------------+           |
| ``use_kibana4_dashboard`` (string, no default)               |           |
+--------------------------------------------------------------+           |
| ``kibana4_start_timedelta`` (time, default: 10 min)          |           |
+--------------------------------------------------------------+           |
| ``kibana4_end_timedelta`` (time, default: 10 min)            |           |
+--------------------------------------------------------------+           |
| ``use_local_time`` (boolean, default True)                   |           |
+--------------------------------------------------------------+           |
| ``realert`` (time, default: 1 min)                           |           |
+--------------------------------------------------------------+           |
| ``exponential_realert`` (time, no default)                   |           |
+--------------------------------------------------------------+           |
| ``match_enhancements`` (list of strs, no default)            |           |
+--------------------------------------------------------------+           |
| ``top_count_number`` (int, default 5)                        |           |
+--------------------------------------------------------------+           |
| ``top_count_keys`` (list of strs)                            |           |
+--------------------------------------------------------------+           |
| ``raw_count_keys`` (boolean, default True)                   |           |
+--------------------------------------------------------------+           |
| ``include`` (list of strs, default ["*"])                    |           |
+--------------------------------------------------------------+           |
| ``filter`` (ES filter DSL, no default)                       |           |
+--------------------------------------------------------------+           |
| ``max_query_size`` (int, default global max_query_size)      |           |
+--------------------------------------------------------------+           |
| ``query_delay`` (time, default 0 min)                        |           |
+--------------------------------------------------------------+           |
| ``owner`` (string, default empty string)                     |           |
+--------------------------------------------------------------+           |
| ``priority`` (int, default 2)                                |           |
|                                                              |           |
| IGNORED IF ``use_count_query`` or ``use_terms_query`` is true|           |
+--------------------------------------------------------------+           +
| ``buffer_time`` (time, default from config.yaml)             |           |
+--------------------------------------------------------------+           |
| ``timestamp_type`` (string, default iso)                     |           |
+--------------------------------------------------------------+           |
| ``timestamp_format`` (string, default "%Y-%m-%dT%H:%M:%SZ")  |           |
+--------------------------------------------------------------+           |
| ``_source_enabled`` (boolean, default True)                  |           |
+--------------------------------------------------------------+-----------+

|

+----------------------------------------------------+--------+-----------+-----------+--------+-----------+-------+----------+--------+-----------+
|      RULE TYPE                                     |   Any  | Blacklist | Whitelist | Change | Frequency | Spike | Flatline |New_term|Cardinality|
+====================================================+========+===========+===========+========+===========+=======+==========+========+===========+
| ``compare_key`` (string, no default)               |        |    Req    |   Req     |  Req   |           |       |          |        |           |
+----------------------------------------------------+--------+-----------+-----------+--------+-----------+-------+----------+--------+-----------+<commit_msg>Specify var types for alert text args<commit_after>Rule Types and Configuration Options
************************************

Examples of several types of rule configuration can be found in the example_rules folder.

.. _commonconfig:

.. note:: All "time" formats are of the form ``unit: X`` where unit is one of weeks, days, hours, minutes or seconds.
    Such as ``minutes: 15`` or ``hours: 1``.


Rule Configuration Cheat Sheet
==============================


+--------------------------------------------------------------------------+
|              FOR ALL RULES                                               |
+==============================================================+===========+
| ``es_host`` (string)                                         |  Required |
+--------------------------------------------------------------+           |
| ``es_port`` (number)                                         |           |
+--------------------------------------------------------------+           |
| ``index`` (string)                                           |           |
+--------------------------------------------------------------+           |
| ``name`` (string)                                            |           |
+--------------------------------------------------------------+           |
| ``type`` (string)                                            |           |
+--------------------------------------------------------------+           |
| ``alert`` (string or list)                                   |           |
+--------------------------------------------------------------+-----------+
| ``use_strftime_index`` (boolean, default False)              |  Optional |
+--------------------------------------------------------------+           |
| ``use_ssl`` (boolean, default False)                         |           |
+--------------------------------------------------------------+           |
| ``verify_certs`` (boolean, default True)                     |           |
+--------------------------------------------------------------+           |
| ``es_username`` (string, no default)                         |           |
+--------------------------------------------------------------+           |
| ``es_password`` (string, no default)                         |           |
+--------------------------------------------------------------+           |
| ``es_url_prefix`` (string, no default)                       |           |
+--------------------------------------------------------------+           |
| ``es_send_get_body_as`` (string, default "GET")              |           |
+--------------------------------------------------------------+           |
| ``aggregation`` (time, no default)                           |           |
+--------------------------------------------------------------+           |
| ``description`` (string, default empty string)               |           |
+--------------------------------------------------------------+           |
| ``generate_kibana_link`` (boolean, default False)            |           |
+--------------------------------------------------------------+           |
| ``use_kibana_dashboard`` (string, no default)                |           |
+--------------------------------------------------------------+           |
| ``kibana_url`` (string, default from es_host)                |           |
+--------------------------------------------------------------+           |
| ``use_kibana4_dashboard`` (string, no default)               |           |
+--------------------------------------------------------------+           |
| ``kibana4_start_timedelta`` (time, default: 10 min)          |           |
+--------------------------------------------------------------+           |
| ``kibana4_end_timedelta`` (time, default: 10 min)            |           |
+--------------------------------------------------------------+           |
| ``use_local_time`` (boolean, default True)                   |           |
+--------------------------------------------------------------+           |
| ``realert`` (time, default: 1 min)                           |           |
+--------------------------------------------------------------+           |
| ``exponential_realert`` (time, no default)                   |           |
+--------------------------------------------------------------+           |
| ``match_enhancements`` (list of strs, no default)            |           |
+--------------------------------------------------------------+           |
| ``top_count_number`` (int, default 5)                        |           |
+--------------------------------------------------------------+           |
| ``top_count_keys`` (list of strs)                            |           |
+--------------------------------------------------------------+           |
| ``raw_count_keys`` (boolean, default True)                   |           |
+--------------------------------------------------------------+           |
| ``include`` (list of strs, default ["*"])                    |           |
+--------------------------------------------------------------+           |
| ``filter`` (ES filter DSL, no default)                       |           |
+--------------------------------------------------------------+           |
| ``max_query_size`` (int, default global max_query_size)      |           |
+--------------------------------------------------------------+           |
| ``query_delay`` (time, default 0 min)                        |           |
+--------------------------------------------------------------+           |
| ``owner`` (string, default empty string)                     |           |
+--------------------------------------------------------------+           |
| ``priority`` (int, default 2)                                |           |
|                                                              |           |
| IGNORED IF ``use_count_query`` or ``use_terms_query`` is true|           |
+--------------------------------------------------------------+           +
| ``buffer_time`` (time, default from config.yaml)             |           |
+--------------------------------------------------------------+           |
| ``timestamp_type`` (string, default iso)                     |           |
+--------------------------------------------------------------+           |
| ``timestamp_format`` (string, default "%Y-%m-%dT%H:%M:%SZ")  |           |
+--------------------------------------------------------------+           |
| ``_source_enabled`` (boolean, default True)                  |           |
+--------------------------------------------------------------+           |
| ``alert_text_args`` (array of strs)                          |           |
+--------------------------------------------------------------+           |
| ``alert_text_kw`` (object)                                   |           |
+--------------------------------------------------------------+-----------+

|

+----------------------------------------------------+--------+-----------+-----------+--------+-----------+-------+----------+--------+-----------+
|      RULE TYPE                                     |   Any  | Blacklist | Whitelist | Change | Frequency | Spike | Flatline |New_term|Cardinality|
+====================================================+========+===========+===========+========+===========+=======+==========+========+===========+
| ``compare_key`` (string, no default)               |        |    Req    |   Req     |  Req   |           |       |          |        |           |
+----------------------------------------------------+--------+-----------+-----------+--------+-----------+-------+----------+--------+-----------+
{'fraction_non_alphanumeric': 0.48775026343519495, 'fraction_numerical': 0.0018440463645943098, 'mean_word_length': 0.4814634146341463, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 73, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5868077', 'n_tokens_mistral': 2554, 'n_tokens_neox': 2422, 'n_words': 486}