Creating % based alerts with elastalert

Question

Currently with rule type Frequency(or any other), we can configure count based alerts.

ex. if Error=404, occurs more than 5 times in last 1 hour.

But I want to configure % based alerts and not count based alert.

ex. If Error=404 goes beyond 10% in last 1 hour.

Is it possible to configure such alert ?

Answer 1

elastAlert allows anyone to create their own rules . So you can inspire yourself from what the frequency rule does and create a new one that works on percentage instead.

In your case, instead of creating a new rule you could simply subclass FrequencyRule and modify the behavior to fit your needs