apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-rule
  namespace: kube-elastalert
  labels:
    k8s-app: elastalert
data:
  rammstein.yaml: |-
    name: Example rule
    type: frequency
    index: logstash-*
    num_events: 50
    timeframe:
        hours: 4
    filter:
    - term:
        some_field: "some_value"
    alert:
    - "email"
    email:
    - "elastalert@example.com"
