Close elastalert alerts if they contain "new_value=up"

templates/elastalert/plugin.py

+import json
 import logging
 
 from alerta.plugins import PluginBase
@@ -14,6 +15,10 @@ class Elastalert(PluginBase):
         super().__init__()
 
     def pre_receive(self, alert, **kwargs):
+        if alert.service.pop() == 'elastalert':
+            if alert.raw_data.find('\nnew_value: [\n    \"up\"\n]') > 0:
+                alert.severity = 'normal'
+                alert.status = 'closed'
         return alert
 
     def post_receive(self, alert, **kwargs):

templates/elastalert/setup.py

@@ -12,8 +12,10 @@ setup(
     author='Jürgen Haas',
     author_email='juergen.haas@lakedrops.com',
     packages=find_packages(),
-    py_modules=[],
-    install_requires=[],
+    py_modules=['alerta_elastalert'],
+    install_requires=[
+        'requests'
+    ],
     include_package_data=True,
     zip_safe=True,
     entry_points={