Problems with "command" alert

Hi there, I’m encountering all sorts of strange issues trying to set up a command alert. Essentially all I want to do is hit an http endpoint with any matching documents. This is the structure I’ve got set up for my command alert:

    alert:
     - command:
         command: "curl -XPOST -H \"Content-Type: application/json\" \"https://my.endpoint\" -d@-"
    pipe_match_json: true

The -d@- option causes curl commands to read from stdin, which as I understand, pipe_match_json should provide.

When I do I get this strange error though: elastalert_error - {'message': 'Error while running alert command: Error while running command c u r l - X P O S T - H " C o n t e n t - T y p e : a p p l i c a t i o n / j s o n " " h t t p s : / / m y . e n d p o i n t" - d @ -: [Errno 2] No such file or directory', 'traceback': ['Traceback (most recent call last):', ' File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.84-py2.7.egg/elastalert/elastalert.py", line 976, in send_alert', ' alert.alert(matches)', ' File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.84-py2.7.egg/elastalert/alerts.py", line 660, in alert', ' raise EAException("Error while running command %s: %s" % (\' \'.join(command), e))', 'EAException: Error while running command c u r l - X P O S T - H " C o n t e n t - T y p e : a p p l i c a t i o n / j s o n " " h t t p s : / / m y . e n d p o i n t " - d @ -: [Errno 2] No such file or directory'], 'data': {'rule': 'Google Microservice Error Alert'}}

In which it seems to be putting spaces in between every letter of my argument. Any thought on what is going on here??

Thanks!

[Qmando]

@reswob10

• Don’t use [ ] if you aren’t going to split up the command. Just keep it as a string, and it will then be interpreted as a shell command.

• What you posted is not valid YAML, you must have run elastalert with something else. You need to escape your DOUBLE quotes

• You don’t need to escape single quotes, elastalert doesn’t escape them, and I’ve just verified that using

command: "curl -v -k 'http://localhost:14901/foo' -d '{\"event\": \"blah\"}'"

works perfectly

[Qmando]

Ah, yeah the one string method is not correct unless shell=True is also passed, which it isnt. You should be using a list to run commands as arguments.

alert:
- command:
    command: ["curl", "-XPOST", "-H" "\"Content-Type: application/json\"", "\"https://my.endpoint\"", "-d@-"]
pipe_match_json: true