elastalert_defaults: drupal: syslog: query: @log_name:"syslog.local0.err" OR @log_name:"syslog.local0.crit" OR @log_name:"syslog.local0.alert" OR @log_name:"syslog.local0.emerg" extra: [] apache: query: access: code:[500 TO 599] error: level:"*error" extra: [] elastalerts: []