Add Dockerfile for an Alpine Linux based image.

[GerardoNevarez]

I've been using a small (65Mb) elastalert Docker image for basic monitoring on our test EFK stack (Elasticsearch-Fluentd-Kibana). The image clones the Yelp/elastalert repo and builds everything from source. To build it:

docker build --no-cache=true -t elastalert:onbuild .

The resulting image can be the base for an environment specific image: a new Dockerfile (below) must reference it, and the config.yaml and rules (inside a /rules folder) would be added as a new layer.

FROM elastalert:onbuild

The image can also be executed with a mounted config.yaml and rules folder. First step is creating the ES index for elastalert:

docker run --rm -v /opt/elastalert/config.yaml:/opt/elastalert/config.yaml -v /opt/elastalert/rules:/opt/elastalert/rules elastalert:onbuild bash -c "elastalert-create-index"

and then run a container:

docker run -d --name elastalert -v /opt/elastalert/config.yaml:/opt/elastalert/config.yaml -v /opt/elastalert/rules:/opt/elastalert/rules elastalert:onbuild

Although my current approach is mounting rules and config from a local volume, some additional ENV variables could be added to customize it (i.e. retrieve config.yaml from a remote URL, ES url, etc)

Might be a starting point for a small, official image in the future. Thoughts?

Gerardo

[Qmando]

Can this read the timezone from the build machine instead of hardcoding EST?

[bean5]

If you want things like timezone setting, I suggest you look at https://github.com/krizsan/elastalert-docker and see if you can bring in some of what is done there, such as checking if the Elastalert index exists in Elasticsearch and create it if it does not. That project also does allows for setting timezone.

But maybe this project already does than anyways? In either case, I think an alpine linux container

[bean5]

Anything blocking this besides the hardcoded timezone?

[bean5]

@GerardoNevarez . Sorry I missed @mentioning the first time around.