Skip to content
Discussion options

You must be logged in to vote

We recently fixed a bug that was causing inactive Plays to continue to alert - that fix will be available in our next release.

For now, you can delete the yaml files in /opt/so/rules/elastalert/playbook/ and then run sudo so-playbook-sync - this will manually turn off the alerting for Plays that are currently inactive.

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by defensivedepth
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants