Make Drupal alert queries customizable

defaults/main.yml

 ES_HEAP_SIZE: 1G
 elastalert_defaults:
   drupal:
-    syslog: []
-    apache: []
+    syslog:
+      query: '@log_name:"syslog.local0.err" OR @log_name:"syslog.local0.crit" OR @log_name:"syslog.local0.alert" OR @log_name:"syslog.local0.emerg"'
+      extra: []
+    apache:
+      query:
+        access: 'code:[500 TO 599]'
+        error: 'level:"*error"'
+      extra: []
 elastalerts: []

templates/alerts/rules/rule.drupal.apache.yaml

@@ -37,7 +37,7 @@ filter: [
     {
         "query_string": {
             "analyze_wildcard": true,
-            "query": "(@log_name:\"apache.error.var.log.apache2.{{ item.1.domain }}-error.log\" AND level:\"*error\") OR (@log_name:\"apache.access.var.log.apache2.{{ item.1.domain }}-access.log\" AND code:[500 TO 599])"
+            "query": {{ ['(@log_name:"apache.error.var.log.apache2.', item.1.domain, '-error.log" AND (', elastalert_defaults.drupal.apache.query.error, ')) OR (@log_name:"apache.access.var.log.apache2.', item.1.domain, '-access.log" AND (', elastalert_defaults.drupal.apache.query.access, '))']|join("")|to_nice_json }}
         }
     }
 ]

templates/alerts/rules/rule.drupal.syslog.yaml

@@ -37,7 +37,7 @@ filter: [
     {
         "query_string": {
             "analyze_wildcard": true,
-            "query": "ident:{{ item.1.domain }} AND (@log_name:\"syslog.local0.err\" OR @log_name:\"syslog.local0.crit\" OR @log_name:\"syslog.local0.alert\" OR @log_name:\"syslog.local0.emerg\")"
+            "query": {{ ['ident:', item.1.domain, ' AND (', elastalert_defaults.drupal.syslog.query, ')']|join("")|to_nice_json }}
         }
     }
 ]