Merge pull request #133 from nsano-rururu/slack_add_footer

Add Slack Alerts Footer
jertel · May 7, 2021 · 13ec5d6 · 13ec5d6
2 parents c2eeebe + 77d2da1
commit 13ec5d6
Show file tree

Hide file tree

Showing 4 changed files with 62 additions and 0 deletions.
diff --git a/docs/source/ruletypes.rst b/docs/source/ruletypes.rst
@@ -2453,6 +2453,10 @@ Example slack_alert_fields::
 
 ``slack_ca_certs``: Set this option to ``True`` if you want to validate the SSL certificate.
 
+``slack_footer``: Add a static footer text for alert. Defaults to "".
+
+``slack_footer_icon``: A Public Url for a footer icon. Defaults to "".
+
 Splunk On-Call (Formerly VictorOps)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

diff --git a/elastalert/alerts.py b/elastalert/alerts.py
@@ -1060,6 +1060,8 @@ def __init__(self, rule):
  self.slack_attach_kibana_discover_url = self.rule.get('slack_attach_kibana_discover_url', False)
  self.slack_kibana_discover_color = self.rule.get('slack_kibana_discover_color', '#ec4b98')
  self.slack_kibana_discover_title = self.rule.get('slack_kibana_discover_title', 'Discover in Kibana')
+ self.footer = self.rule.get('slack_footer', '')
+ self.footer_icon = self.rule.get('slack_footer_icon', '')
 
  def format_body(self, body):
  # https://api.slack.com/docs/formatting
@@ -1122,6 +1124,10 @@ def alert(self, matches):
  if self.slack_title_link != '':
  payload['attachments'][0]['title_link'] = self.slack_title_link
 
+ if self.footer != '' and self.footer_icon != '':
+ payload['attachments'][0]['footer'] = self.footer
+ payload['attachments'][0]['footer_icon'] = self.footer_icon
+
  if self.slack_attach_kibana_discover_url:
  kibana_discover_url = lookup_es_key(matches[0], 'kibana_discover_url')
  if kibana_discover_url:

diff --git a/elastalert/schema.yaml b/elastalert/schema.yaml
@@ -282,6 +282,8 @@ properties:
  slack_attach_kibana_discover_url: {type: boolean}
  slack_kibana_discover_color: {type: string}
  slack_kibana_discover_title: {type: string}
+ slack_footer: {type: string}
+ slack_footer_icon: {type: string}
 
  ### Mattermost
  mattermost_webhook_url: *arrayOfString

diff --git a/tests/alerts_test.py b/tests/alerts_test.py
@@ -2749,6 +2749,56 @@ def test_slack_ca_certs():
  assert expected_data == json.loads(mock_post_request.call_args_list[0][1]['data'])
 
 
+def test_slack_footer():
+ rule = {
+ 'name': 'Test Rule',
+ 'type': 'any',
+ 'slack_webhook_url': 'http://please.dontgohere.slack',
+ 'slack_username_override': 'elastalert',
+ 'slack_footer': 'Elastic Alerts',
+ 'slack_footer_icon': 'http://footer.icon.url',
+ 'alert_subject': 'Cool subject',
+ 'alert': []
+ }
+ rules_loader = FileRulesLoader({})
+ rules_loader.load_modules(rule)
+ alert = SlackAlerter(rule)
+ match = {
+ '@timestamp': '2016-01-01T00:00:00',
+ 'somefield': 'foobarbaz'
+ }
+ with mock.patch('requests.post') as mock_post_request:
+ alert.alert([match])
+
+ expected_data = {
+ 'username': 'elastalert',
+ 'channel': '',
+ 'icon_emoji': ':ghost:',
+ 'attachments': [
+ {
+ 'color': 'danger',
+ 'title': rule['alert_subject'],
+ 'text': BasicMatchString(rule, match).__str__(),
+ 'mrkdwn_in': ['text', 'pretext'],
+ 'fields': [],
+ 'footer': 'Elastic Alerts',
+ 'footer_icon': 'http://footer.icon.url'
+ }
+ ],
+ 'text': '',
+ 'parse': 'none'
+ }
+ mock_post_request.assert_called_once_with(
+ rule['slack_webhook_url'],
+ data=mock.ANY,
+ headers={'content-type': 'application/json'},
+ proxies=None,
+ verify=True,
+ timeout=10
+ )
+ assert expected_data == json.loads(mock_post_request.call_args_list[0][1]['data'])
+
+
 def test_http_alerter_with_payload():
  rule = {
  'name': 'Test HTTP Post Alerter With Payload',