Package: ncc-reactor
ReactorReactor started as a fork of the open source projectElastAlert. The maintainer of
this project should keep close tabs on the changes to ElastAlert (excluding their additional alerters) and ensure that
any relevant bugs fixes be patched in and any useful feature ported in.Reactor is an alerting engine which takes in a set of rules with custom filters and alerts on matches.
Reactor automatically updates silenced alerts with repeat alert information.Patch history from ElastAlertDate accessedCommitNotes2019-10-16325f1dfe7a45f3ca2a2cc00127ab71fcd4f9ceadWent back until before Reactor was first created.2020-01-09ec5d03b95708ea0aa3d29c065f9794fdd95a82a1We do not use coverage.Supported VersionsCurrently Reactor supports ElasticSearch 5.x.x, 6.x.x, and 7.x.x
As new versions of elasticsearch become available Reactor will be updated to support.
There is no intention to add support for older versions of ElasticSearch.
Currently, there is no date to remove support for older versions of ElasticSearch. If ElasticSearch's python library
removes support we are likely to follow suite.CompatibilityAs per ElasticSearch's python library's guidelines is is recommended to use install the version of the library with the
same major version as the cluster.ForElasticsearch 7.0and later, use the major version 7 (elasticsearch<8.0.0,>=7.0.0).ForElasticsearch 6.0and later, use the major version 6 (elasticsearch<7.0.0,>=6.0.0).ForElasticsearch 5.0and later, use the major version 5 (elasticsearch<6.0.0,>=5.0.0).Please note there is aknown bugintroduced version6.4.0of the ElasticSearch library which was fixed in7.0.4but not in major version 6. The bug puts thescroll_idin
the query parameter which can cause Elasticsearch to return400status codes for valid scroll ids.DevelopmentYou can start an elasticsearch instance inside docker for local development using the following command:$dockerrun-d-p9200:9200/tcp--nameelasticsearchdocker.elastic.co/elasticsearch/elasticsearch:<version>And the following configuration inconfig.yaml:writeback_index:reactoralert_alias:reactor_alertselasticsearch:&elasticsearchhost:localhostport:9200# Global settings to be applied to every runrule:elasticsearch:*elasticsearchGit HooksThis project provides git hooks to stop user error. Please run the following commands:$cp.git-hooks-pre-push.git/hooks/pre-pushRunning testsReactor is covered by two types of testing: unit and integration. Unit testing to ensure
individual functions and logic flows work correctly; integration testing to ensure that the
whole system works in unison.UnitThe unit tests are written using PyTest. To run all the tests run the following command:$py.testIntegrationThe unit tests are executed in docker and require a.envfile in the project's root directory.
The tests require the follow contents inside the the.envfile:# The ElasticSearch version to be tested, reactor supports >= 5.x.x
ES_VERSION=6.3.2
# Basic configuration information so that reactor can query ElasticSearch
ES_HOST=elasticsearch
ES_USER=elastic
ES_PASSWORD=changemeThe integration Docker Compose filetest.docker-compose.ymlhas 3 environment variables that
are required for >= v7.x.x which will break older versions:node.name=elasticsearch
discovery.seed_hosts=elasticsearch
cluster.initial_master_nodes=elasticsearchTo execute the integration tests run the following command:$docker-compose-fdocker-compose-test.ymlup--abort-on-container-exit--buildreactorelasticsearchCreate SSL certs for RAFT leadershipThe following set of commands (performed in./certs/) will create a set a CA and device certificate for running the mock cluster on localhost:#Onlydoonce:generatetherootCAkey:$opensslgenrsa-outtransport-ca.key4096#GeneratetherootCAcertificate:## Country Name (2 letter code) []:GB## State or Province Name (full name) []:.## Locality Name (eg, city) []:.## Organization Name (eg, company) []:.## Organizational Unit Name (eg, section) []:.## Common Name (eg, fully qualified host name) []:PyRaftLog## Email Address []:.$opensslreq-x509-new-nodes-keytransport-ca.key-sha256-days1024-outtransport-ca.pem#Generatedevicecertificates#Onlydoonce:generatedevicekey:$opensslgenrsa-outtransport-consensus.key4096#Generatedevicecertificatesigningrequest:## Country Name (2 letter code) []:GB## State or Province Name (full name) []:.## Locality Name (eg, city) []:.## Organization Name (eg, company) []:.## Organizational Unit Name (eg, section) []:.## Common Name (eg, fully qualified host name) []:localhost## Email Address []:.$opensslreq-new-keytransport-consensus.key-outtransport-consensus.csr#Generateasigneddevicecertificate:$opensslx509-req-intransport-consensus.csr-CAtransport-ca.pem-CAkeytransport-ca.key-CAcreateserial-outtransport-consensus.crt-days500-sha256Build documentationTo build the documentation:$pipinstall-rrequirements-docs.txt$cddocs$sphinx-build-bhtml-dbuild/doctrees-Wsourcebuild/htmlPublish to PyPipip install --upgrade setuptools wheelpip install --upgrade twinepython3 setup.py sdist bdist_wheeltwine check dist/*twine upload --skip-existing dist/*  --verbose