main.yml

elastalert_defaults:
  drupal:
    syslog:
      query: @log_name:"syslog.local0.err" OR @log_name:"syslog.local0.crit" OR @log_name:"syslog.local0.alert" OR @log_name:"syslog.local0.emerg"
      extra: []
    apache:
      query:
        access: code:[500 TO 599]
        error: level:"*error"
      extra: []
elastalerts: []