ElastAlert 2 rule types
Each alerting rule sets type: to choose how matches are detected. Every type guide opens with a short overview, then an Options section: first Fields every rule needs (the YAML skeleton common to all types), then Required for this type and optional keys for that type, followed by a Full working example and usually a real-world example. Cross-rule options such as buffer_time, run_every, realert, and is_enabled are covered in the Full Reference and Create a rule.
Fields every rule needs
Regardless of type, every ElastAlert 2 rule must define name, index, type, filter, and alert (plus the settings each destination needs under alert:). The per-type guides below add Required for this type only for keys that belong to that rule type.
Adjust index and queries to match your data.
For notification wording and Discover links across all types, see Subject & body and Context & links. For alert: channels, see Destinations.