rule.yaml

es_host: 'localhost'
es_port: 9200
index: '{{ item.index|default("logstash-*") }}'
name: '{{ item.name }}'
description: '{{ item.description }}'
type: '{{ item.type }}'
alert:
{% for alert in item.alert %}
  - '{{ alert }}'
{% endfor %}
include:
  - 'hostname'
{% for entry in ['alert_subject', 'alert_text'] %}
{% if item[entry] is defined %}
{{ entry }}: '{{ item[entry] }}'
{% endif %}
{% endfor %}
{% for entry in ['alert_subject_args', 'alert_text_args'] %}
{% if item[entry] is defined %}
{{ entry }}:
{% for line in item[entry] %}
  - '{{ line }}'
{% endfor %}
{% endif %}
{% endfor %}

{% for extra in item.extra|default([]) %}
{{ extra }}: {{ item.extra[extra]|to_nice_json }}
{% endfor %}