🚀 Service Unit: ElastAlert Setup and Logging

This guide explains how to configure ElastAlert on Ubuntu so it automatically starts after reboot, stores logs in a dedicated file, and manages log rotation. Perfect for adding to your public GitHub repo 📂.

Suggested Repository Name: elastalert-service-unit

---

🖥️ Server Details

• OS: Ubuntu 22.04.4 LTS (Amazon EC2)
• Hostname: ip-10-0-0-222
• Python: 3.x
• ElastAlert Directory: /opt/elastalert
• Config File: /opt/elastalert/config.yaml

---

⚙️ Step 1: Create a systemd Service

1️⃣ Create service file

sudo nano /etc/systemd/system/elastalert.service

2️⃣ Add the following content

[Unit]
Description=ElastAlert Service
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/elastalert
ExecStart=/usr/bin/python3 -m elastalert.elastalert --config /opt/elastalert/config.yaml --verbose
Restart=always
RestartSec=5
User=root
StandardOutput=append:/var/log/elastalert/elastalert.log
StandardError=append:/var/log/elastalert/elastalert.log

[Install]
WantedBy=multi-user.target

3️⃣ Reload and enable service

sudo systemctl daemon-reload
sudo systemctl enable elastalert
sudo systemctl start elastalert

✅ Check service status:

sudo systemctl status elastalert

📜 View logs:

tail -f /var/log/elastalert/elastalert.log

---

📁 Step 2: Create Log Directory

sudo mkdir -p /var/log/elastalert
sudo touch /var/log/elastalert/elastalert.log
sudo chown root:root /var/log/elastalert/elastalert.log

💡 Ensure proper permissions so ElastAlert can write logs.

---

🔄 Step 3: Configure Logrotate

3.1 Create logrotate config

sudo nano /etc/logrotate.d/elastalert

3.2 Add the following

/var/log/elastalert/elastalert.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}

3.3 Explanation

• 📅 daily → Rotate logs every day
• 🔄 rotate 7 → Keep only the last 7 rotations
• 📦 compress → Gzip old logs
• ⏳ delaycompress → Compress starting from the 2nd rotation
• ✅ missingok → Skip if file is missing
• 🚫 notifempty → Don’t rotate empty files
• ✂️ copytruncate → Truncate active log safely while running

3.4 Test the rotation

sudo logrotate -f /etc/logrotate.d/elastalert
ls -lh /var/log/elastalert/

Expected output:

elastalert.log
elastalert.log.1.gz
elastalert.log.2.gz
...
elastalert.log.7.gz

---

🎯 Outcome

• ✅ ElastAlert runs automatically on reboot.
• 📝 Logs stored at /var/log/elastalert/elastalert.log.
• ♻️ Logs rotate daily, with 7-day retention and compression.

---

📌 Pro Tip

Add screenshots of your service status and logrotate output to your repo’s README for better visuals 🌟.

---

💬 Contribution: PRs welcome to improve this guide or automate it via a bash script.

---

📄 License: MIT