Why is the match_time and alert_time so different?

[vutuong]

This is my rule config:

name: test
type: frequency
es_host: es-http
es_port: 9200
es_username: elastalert
es_password: 123
use_ssl: True
index: os-log
timestamp_field: "os_time"
enabled: true
verify_certs: False
num_events: 1
timeframe:
    minutes: 3
run_every:
    minutes: 3
filter:
  - term:
      junos_eventname.keyword: "UI_LOGIN_EVENT"
  - term:
      junos_hostname.keyword: "TEST-DEVICE
alert:
    - "email"
email:
    - "example.com.vn"
smtp_auth_file: "/opt/elastalert/alerts/email/tech.com.vn.yaml"
from_addr: "ElastAlert"
smtp_host: "1.1.1.1"
smtp_port: 25
smtp_ssl: False

I got this data from elastalert index:

Because match_time is same as my raw log time. I wonder why match_time and alert_time so different? How can I set to display the alert history from elastalert metadata each 5 minute as match_time ?

[jertel]

I've already answered the first question in #1602.

I don't understand the second question.

Please review the code. That's how I learned the project, and that's why it's open source.

[vutuong]

@jertel As you can see the picture that I uploaded, The match_time is a field in the mapping and not included in the match_body. I wonder about match_time and not the match_body.

[jertel]

My answer remains correct. match_time == @timestamp