elastalert2 2.29.0__tar.gz → 2.30.0__tar.gz

{elastalert2-2.29.0/elastalert2.egg-info → elastalert2-2.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: elastalert2
-Version: 2.29.0
+Version: 2.30.0
 Summary: Automated rule-based alerting for Elasticsearch
 Home-page: https://github.com/jertel/elastalert2
 License: Apache 2.0
@@ -15,32 +15,32 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: apscheduler<4.0,>=3.11.0
+Requires-Dist: apscheduler<4.0,>=3.11.2
 Requires-Dist: aws-requests-auth>=0.4.3
-Requires-Dist: boto3>=1.40.59
+Requires-Dist: boto3>=1.42.89
 Requires-Dist: cffi>=2.0.0
-Requires-Dist: croniter>=6.0.0
+Requires-Dist: croniter>=6.2.2
 Requires-Dist: elasticsearch==7.10.1
 Requires-Dist: envparse>=0.2.0
 Requires-Dist: exotel==0.1.5
 Requires-Dist: Jinja2>=3.1.6
 Requires-Dist: jira>=3.10.5
-Requires-Dist: jsonpointer>=3.0.0
-Requires-Dist: jsonschema>=4.25.1
-Requires-Dist: prettytable>=3.16.0
+Requires-Dist: jsonpointer>=3.1.1
+Requires-Dist: jsonschema>=4.26.0
+Requires-Dist: prettytable>=3.17.0
 Requires-Dist: prison>=0.2.1
-Requires-Dist: prometheus_client>=0.23.1
+Requires-Dist: prometheus-client>=0.25.0
 Requires-Dist: python-dateutil>=2.9.0.post0
-Requires-Dist: pytz>=2026.1
+Requires-Dist: pytz>=2026.1.post1
 Requires-Dist: PyYAML>=6.0.3
-Requires-Dist: zabbix-utils>=2.0.3
-Requires-Dist: requests>=2.31.0
+Requires-Dist: zabbix-utils>=2.0.4
+Requires-Dist: requests>=2.33.1
 Requires-Dist: sortedcontainers>=2.4.0
 Requires-Dist: statsd-tags==3.2.1.post1
 Requires-Dist: stomp.py>=8.2.0
-Requires-Dist: tencentcloud-sdk-python>=3.0.1479
+Requires-Dist: tencentcloud-sdk-python>=3.1.79
 Requires-Dist: texttable>=1.7.0
-Requires-Dist: twilio>=9.8.4
+Requires-Dist: twilio>=9.10.5
 Dynamic: classifier
 Dynamic: description
 Dynamic: description-content-type

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert/alerters/datadog.py

@@ -1,8 +1,6 @@
 import json
-
 import requests
 from requests import RequestException
-
 from elastalert.alerts import Alerter, DateTimeEncoder
 from elastalert.util import EAException, elastalert_logger
 
@@ -15,9 +13,9 @@ class DatadogAlerter(Alerter):
         super(DatadogAlerter, self).__init__(rule)
         self.dd_api_key = self.rule.get('datadog_api_key', None)
         self.dd_app_key = self.rule.get('datadog_app_key', None)
+        self.dd_api_url = self.rule.get('datadog_api_url', 'https://api.datadoghq.com/api/v1/events')
 
     def alert(self, matches):
-        url = 'https://api.datadoghq.com/api/v1/events'
         headers = {
             'Content-Type': 'application/json',
             'DD-API-KEY': self.dd_api_key,
@@ -28,7 +26,7 @@ class DatadogAlerter(Alerter):
             'text': self.create_alert_body(matches)
         }
         try:
-            response = requests.post(url, data=json.dumps(payload, cls=DateTimeEncoder), headers=headers)
+            response = requests.post(self.dd_api_url, data=json.dumps(payload, cls=DateTimeEncoder), headers=headers)
             response.raise_for_status()
         except RequestException as e:
             raise EAException('Error posting event to Datadog: %s' % e)

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert/alerts.py

@@ -256,10 +256,25 @@ class Alerter(object):
             if not isinstance(summary_table_fields, list):
                 summary_table_fields = [summary_table_fields]
 
+            # Each entry is either a string field path, or a dict with required 'path' and optional 'header'.
+            # Split into parallel lists so paths drive lookups/logging while headers drive rendered column names.
+            summary_table_paths = []
+            summary_table_headers = []
+            for entry in summary_table_fields:
+                if isinstance(entry, dict):
+                    path = entry['path']
+                    header = entry.get('header', path)
+                else:
+                    path = entry
+                    header = entry
+                summary_table_paths.append(path)
+                summary_table_headers.append(header)
+
             # Include a count aggregation so that we can see at a glance how many of each aggregation_key were encountered
-            summary_table_fields_with_count = summary_table_fields + ['count']
+            summary_table_paths_with_count = summary_table_paths + ['count']
+            summary_table_headers_with_count = summary_table_headers + ['count']
             text += "Aggregation resulted in the following data for summary_table_fields ==> {0}:\n\n".format(
-                summary_table_fields_with_count
+                summary_table_paths_with_count
             )
 
             # Prepare match_aggregation used in both table types
@@ -267,7 +282,7 @@ class Alerter(object):
 
             # Maintain an aggregate count for each unique key encountered in the aggregation period
             for match in matches:
-                key_tuple = tuple([str(lookup_es_key(match, key)) for key in summary_table_fields])
+                key_tuple = tuple([str(lookup_es_key(match, key)) for key in summary_table_paths])
                 if key_tuple not in match_aggregation:
                     match_aggregation[key_tuple] = 1
                 else:
@@ -281,9 +296,9 @@ class Alerter(object):
             # Type dependent table style
             if summary_table_type == 'ascii':
                 text_table = Texttable(max_width=self.get_aggregation_summary_text__maximum_width())
-                text_table.header(summary_table_fields_with_count)
+                text_table.header(summary_table_headers_with_count)
                 # Format all fields as 'text' to avoid long numbers being shown as scientific notation
-                text_table.set_cols_dtype(['t' for i in summary_table_fields_with_count])
+                text_table.set_cols_dtype(['t' for i in summary_table_headers_with_count])
 
                 for keys, count in match_aggregation.items():
                     text_table.add_row([key for key in keys] + [count])
@@ -292,9 +307,9 @@ class Alerter(object):
             elif summary_table_type == 'markdown':
                 # Adapted from https://github.com/codazoda/tomark/blob/master/tomark/tomark.py
                 # Create table header
-                text += '| ' + ' | '.join(map(str, summary_table_fields_with_count)) + ' |\n'
+                text += '| ' + ' | '.join(map(str, summary_table_headers_with_count)) + ' |\n'
                 # Create header separator
-                text += '|-----' * len(summary_table_fields_with_count) + '|\n'
+                text += '|-----' * len(summary_table_headers_with_count) + '|\n'
                 # Create table row
                 for keys, count in match_aggregation.items():
                     markdown_row = ""
@@ -302,12 +317,12 @@ class Alerter(object):
                         markdown_row += '| ' + str(key) + ' '
                     text += markdown_row + '| ' + str(count) + ' |\n'
                 text += '\n'
-            
+
             elif summary_table_type == 'html':
                 # Portions of the following block of HTML formatting code was taken from
                 # an abandoned PR (https://github.com/jertel/elastalert2/pull/1227).
                 text_table = PrettyTable()
-                text_table.field_names = summary_table_fields_with_count
+                text_table.field_names = summary_table_headers_with_count
                 text_table.set_style(TableStyle.MSWORD_FRIENDLY)
                 text_table.border = True
                 text_table.header = True

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert/elastalert.py

@@ -1606,7 +1606,7 @@ class ElastAlerter(object):
 
                     # Delete it from the index
                     try:
-                        self.writeback_es.delete(index=self.writeback_index, id=_id)
+                        self.writeback_es.delete_by_query(index=self.writeback_index, body={'query': {'term': {'_id': _id}}})
                     except ElasticsearchException:  # TODO: Give this a more relevant exception, try:except: is evil.
                         self.handle_error("Failed to delete alert %s at %s" % (_id, alert_time))
 
@@ -1640,7 +1640,7 @@ class ElastAlerter(object):
                                            size=self.max_aggregation)
             for match in res['hits']['hits']:
                 matches.append(match['_source'])
-                self.writeback_es.delete(index=self.writeback_index, id=match['_id'])
+                self.writeback_es.delete_by_query(index=self.writeback_index, body={'query': {'term': {'_id': match['_id']}}})
         except (KeyError, ElasticsearchException) as e:
             self.handle_error("Error fetching aggregated matches: %s" % (e), {'id': _id})
         return matches

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert/loaders.py

@@ -53,7 +53,6 @@ from elastalert.alerters.slack import SlackAlerter
 from elastalert.alerters.smseagle import SMSEagleAlerter
 from elastalert.alerters.sns import SnsAlerter
 from elastalert.alerters.sqs import SqsAlerter
-from elastalert.alerters.teams import MsTeamsAlerter
 from elastalert.alerters.powerautomate import MsPowerAutomateAlerter
 from elastalert.alerters.yzj import YzjAlerter
 from elastalert.alerters.zabbix import ZabbixAlerter
@@ -117,7 +116,6 @@ class RulesLoader(object):
         'command': elastalert.alerters.command.CommandAlerter,
         'sns': SnsAlerter,
         'sqs': SqsAlerter,
-        'ms_teams': MsTeamsAlerter,
         'ms_power_automate': MsPowerAutomateAlerter,
         'slack': SlackAlerter,
         'mattermost': MattermostAlerter,

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert/schema.yaml

@@ -51,13 +51,6 @@ definitions:
     type: array
     items: *slackField
 
-  msTeamsFact: &msTeamsFact
-    type: object
-    additionalProperties: false
-    properties:
-      name: {type: string}
-      value: {type: string}
-
   msPowerAutomateFact: &msPowerAutomateFact
     type: object
     additionalProperties: false
@@ -65,10 +58,6 @@ definitions:
       name: {type: string}
       value: {type: string}
 
-  arrayOfMsTeamsFacts: &arrayOfMsTeamsFacts
-    type: array
-    items: *msTeamsFact
-
   arrayOfMsPowerAutomateFacts: &arrayOfMsPowerAutomateFacts
     type: array
     items: *msPowerAutomateFact
@@ -319,7 +308,17 @@ properties:
   notify_all_errors: {type: boolean}
 
   ### summary table
-  summary_table_fields: {type: array, items: {type: string}}
+  summary_table_fields:
+    type: array
+    items:
+      oneOf:
+        - type: string
+        - type: object
+          additionalProperties: false
+          required: [path]
+          properties:
+            path: {type: string, minLength: 1}
+            header: {type: string}
   summary_table_type: {type: string, enum: ['ascii', 'html', 'markdown']}
   summary_table_max_rows: {type: integer, minimum: 0}
   summary_prefix: {type: string}
@@ -468,6 +467,7 @@ properties:
   ### Datadog
   datadog_api_key: {type: string}
   datadog_app_key: {type: string}
+  datadog_api_url: {type: string}
 
   ### Dingtalk
   dingtalk_access_token: {type: string}
@@ -710,22 +710,6 @@ properties:
   mattermost_opensearch_discover_color: {type: string}
   mattermost_opensearch_discover_title: {type: string}
 
-
-  ### Microsoft Teams
-  ms_teams_webhook_url: *arrayOfString
-  ms_teams_alert_summary: {type: string}
-  ms_teams_theme_color: {type: string}
-  ms_teams_proxy: {type: string}
-  ms_teams_alert_fixed_width: {type: boolean}
-  ms_teams_alert_facts: *arrayOfMsTeamsFacts
-  ms_teams_attach_kibana_discover_url: {type: boolean}
-  ms_teams_kibana_discover_title: {type: string}
-  ms_teams_ca_certs: {type: [boolean, string]}
-  ms_teams_ignore_ssl_errors: {type: boolean}
-  ms_teams_attach_opensearch_discover_url: {type: boolean}
-  ms_teams_opensearch_discover_title: {type: string}
-
-
   ### Microsoft Power Automate
   ms_power_automate_webhook_url: *arrayOfString
   ms_power_automate_webhook_url_from_field: { type: string }

{elastalert2-2.29.0 → elastalert2-2.30.0/elastalert2.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: elastalert2
-Version: 2.29.0
+Version: 2.30.0
 Summary: Automated rule-based alerting for Elasticsearch
 Home-page: https://github.com/jertel/elastalert2
 License: Apache 2.0
@@ -15,32 +15,32 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: apscheduler<4.0,>=3.11.0
+Requires-Dist: apscheduler<4.0,>=3.11.2
 Requires-Dist: aws-requests-auth>=0.4.3
-Requires-Dist: boto3>=1.40.59
+Requires-Dist: boto3>=1.42.89
 Requires-Dist: cffi>=2.0.0
-Requires-Dist: croniter>=6.0.0
+Requires-Dist: croniter>=6.2.2
 Requires-Dist: elasticsearch==7.10.1
 Requires-Dist: envparse>=0.2.0
 Requires-Dist: exotel==0.1.5
 Requires-Dist: Jinja2>=3.1.6
 Requires-Dist: jira>=3.10.5
-Requires-Dist: jsonpointer>=3.0.0
-Requires-Dist: jsonschema>=4.25.1
-Requires-Dist: prettytable>=3.16.0
+Requires-Dist: jsonpointer>=3.1.1
+Requires-Dist: jsonschema>=4.26.0
+Requires-Dist: prettytable>=3.17.0
 Requires-Dist: prison>=0.2.1
-Requires-Dist: prometheus_client>=0.23.1
+Requires-Dist: prometheus-client>=0.25.0
 Requires-Dist: python-dateutil>=2.9.0.post0
-Requires-Dist: pytz>=2026.1
+Requires-Dist: pytz>=2026.1.post1
 Requires-Dist: PyYAML>=6.0.3
-Requires-Dist: zabbix-utils>=2.0.3
-Requires-Dist: requests>=2.31.0
+Requires-Dist: zabbix-utils>=2.0.4
+Requires-Dist: requests>=2.33.1
 Requires-Dist: sortedcontainers>=2.4.0
 Requires-Dist: statsd-tags==3.2.1.post1
 Requires-Dist: stomp.py>=8.2.0
-Requires-Dist: tencentcloud-sdk-python>=3.0.1479
+Requires-Dist: tencentcloud-sdk-python>=3.1.79
 Requires-Dist: texttable>=1.7.0
-Requires-Dist: twilio>=9.8.4
+Requires-Dist: twilio>=9.10.5
 Dynamic: classifier
 Dynamic: description
 Dynamic: description-content-type

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert2.egg-info/SOURCES.txt

@@ -57,7 +57,6 @@ elastalert/alerters/smseagle.py
 elastalert/alerters/sns.py
 elastalert/alerters/sqs.py
 elastalert/alerters/stomp.py
-elastalert/alerters/teams.py
 elastalert/alerters/telegram.py
 elastalert/alerters/tencentsms.py
 elastalert/alerters/thehive.py
@@ -119,7 +118,6 @@ tests/alerters/smseagle_test.py
 tests/alerters/sns_test.py
 tests/alerters/sqs_test.py
 tests/alerters/stomp_test.py
-tests/alerters/teams_test.py
 tests/alerters/telegram_test.py
 tests/alerters/tencentsms_test.py
 tests/alerters/thehive_test.py

{elastalert2-2.29.0 → elastalert2-2.30.0}/elastalert2.egg-info/requires.txt

@@ -1,26 +1,26 @@
-apscheduler<4.0,>=3.11.0
+apscheduler<4.0,>=3.11.2
 aws-requests-auth>=0.4.3
-boto3>=1.40.59
+boto3>=1.42.89
 cffi>=2.0.0
-croniter>=6.0.0
+croniter>=6.2.2
 elasticsearch==7.10.1
 envparse>=0.2.0
 exotel==0.1.5
 Jinja2>=3.1.6
 jira>=3.10.5
-jsonpointer>=3.0.0
-jsonschema>=4.25.1
-prettytable>=3.16.0
+jsonpointer>=3.1.1
+jsonschema>=4.26.0
+prettytable>=3.17.0
 prison>=0.2.1
-prometheus_client>=0.23.1
+prometheus-client>=0.25.0
 python-dateutil>=2.9.0.post0
-pytz>=2026.1
+pytz>=2026.1.post1
 PyYAML>=6.0.3
-zabbix-utils>=2.0.3
-requests>=2.31.0
+zabbix-utils>=2.0.4
+requests>=2.33.1
 sortedcontainers>=2.4.0
 statsd-tags==3.2.1.post1
 stomp.py>=8.2.0
-tencentcloud-sdk-python>=3.0.1479
+tencentcloud-sdk-python>=3.1.79
 texttable>=1.7.0
-twilio>=9.8.4
+twilio>=9.10.5

{elastalert2-2.29.0 → elastalert2-2.30.0}/setup.py

@@ -8,7 +8,7 @@ from setuptools import setup
 base_dir = os.path.dirname(__file__)
 setup(
     name='elastalert2',
-    version='2.29.0',
+    version='2.30.0',
     description='Automated rule-based alerting for Elasticsearch',
     long_description=open('README.md').read(),
     long_description_content_type="text/markdown",
@@ -35,31 +35,31 @@ setup(
     package_data={'elastalert': ['schema.yaml', 'es_mappings/**/*.json']},
     python_requires='>=3.12',
     install_requires=[
-        'apscheduler>=3.11.0,<4.0',
+        'apscheduler>=3.11.2,<4.0',
         'aws-requests-auth>=0.4.3',
-        'boto3>=1.40.59',
+        'boto3>=1.42.89',
         'cffi>=2.0.0',
-        'croniter>=6.0.0',
+        'croniter>=6.2.2',
         'elasticsearch==7.10.1',
         'envparse>=0.2.0',
         'exotel==0.1.5',
         'Jinja2>=3.1.6',
         'jira>=3.10.5',
-        'jsonpointer>=3.0.0',
-        'jsonschema>=4.25.1',
-        'prettytable>=3.16.0',
+        'jsonpointer>=3.1.1',
+        'jsonschema>=4.26.0',
+        'prettytable>=3.17.0',
         'prison>=0.2.1',
-        'prometheus_client>=0.23.1',
+        'prometheus-client>=0.25.0',
         'python-dateutil>=2.9.0.post0',
-        'pytz>=2026.1',
+        'pytz>=2026.1.post1',
         'PyYAML>=6.0.3',
-        'zabbix-utils>=2.0.3',
-        'requests>=2.31.0',
+        'zabbix-utils>=2.0.4',
+        'requests>=2.33.1',
         'sortedcontainers>=2.4.0',
         'statsd-tags==3.2.1.post1',
         'stomp.py>=8.2.0',
-        'tencentcloud-sdk-python>=3.0.1479',
+        'tencentcloud-sdk-python>=3.1.79',
         'texttable>=1.7.0',
-        'twilio>=9.8.4',
+        'twilio>=9.10.5',
     ]
 )

{elastalert2-2.29.0 → elastalert2-2.30.0}/tests/alerters/datadog_test.py

@@ -49,6 +49,73 @@ def test_datadog_alerter(caplog):
     assert ('elastalert', logging.INFO, 'Alert sent to Datadog') == caplog.record_tuples[0]
 
 
+def test_datadog_alerter_custom_api_url(caplog):
+    """datadog_api_url overrides the default endpoint when provided."""
+    caplog.set_level(logging.INFO)
+    rule = {
+        'name': 'Test Datadog Event Alerter',
+        'type': 'any',
+        'datadog_api_key': 'test-api-key',
+        'datadog_app_key': 'test-app-key',
+        'datadog_api_url': 'https://api.us5.datadoghq.com/api/v1/events',
+        'alert': [],
+        'alert_subject': 'Test Datadog Event Alert'
+    }
+    rules_loader = FileRulesLoader({})
+    rules_loader.load_modules(rule)
+    alert = DatadogAlerter(rule)
+    match = {
+        '@timestamp': '2021-01-01T00:00:00',
+        'name': 'datadog-test-name'
+    }
+    with mock.patch('requests.post') as mock_post_request:
+        alert.alert([match])
+
+    mock_post_request.assert_called_once_with(
+        'https://api.us5.datadoghq.com/api/v1/events',
+        data=mock.ANY,
+        headers={
+            'Content-Type': 'application/json',
+            'DD-API-KEY': rule['datadog_api_key'],
+            'DD-APPLICATION-KEY': rule['datadog_app_key']
+        }
+    )
+    assert ('elastalert', logging.INFO, 'Alert sent to Datadog') == caplog.record_tuples[0]
+
+
+def test_datadog_alerter_default_api_url(caplog):
+    """datadog_api_url defaults to the US1 endpoint when not provided."""
+    caplog.set_level(logging.INFO)
+    rule = {
+        'name': 'Test Datadog Event Alerter',
+        'type': 'any',
+        'datadog_api_key': 'test-api-key',
+        'datadog_app_key': 'test-app-key',
+        'alert': [],
+        'alert_subject': 'Test Datadog Event Alert'
+    }
+    rules_loader = FileRulesLoader({})
+    rules_loader.load_modules(rule)
+    alert = DatadogAlerter(rule)
+    match = {
+        '@timestamp': '2021-01-01T00:00:00',
+        'name': 'datadog-test-name'
+    }
+    with mock.patch('requests.post') as mock_post_request:
+        alert.alert([match])
+
+    mock_post_request.assert_called_once_with(
+        'https://api.datadoghq.com/api/v1/events',
+        data=mock.ANY,
+        headers={
+            'Content-Type': 'application/json',
+            'DD-API-KEY': rule['datadog_api_key'],
+            'DD-APPLICATION-KEY': rule['datadog_app_key']
+        }
+    )
+    assert ('elastalert', logging.INFO, 'Alert sent to Datadog') == caplog.record_tuples[0]
+
+
 def test_datadog_ea_exception():
     with pytest.raises(EAException) as ea:
         rule = {

elastalert2-2.29.0/elastalert/alerters/teams.py

@@ -1,120 +0,0 @@
-import copy
-import json
-import requests
-
-from elastalert.alerts import Alerter, DateTimeEncoder
-from elastalert.util import EAException, elastalert_logger, lookup_es_key
-from requests.exceptions import RequestException
-
-
-class MsTeamsAlerter(Alerter):
-    """ Creates a Microsoft Teams Conversation Message for each alert """
-    required_options = frozenset(['ms_teams_webhook_url'])
-
-    def __init__(self, rule):
-        super(MsTeamsAlerter, self).__init__(rule)
-        self.ms_teams_webhook_url = self.rule.get('ms_teams_webhook_url', None)
-        if isinstance(self.ms_teams_webhook_url, str):
-            self.ms_teams_webhook_url = [self.ms_teams_webhook_url]
-        self.ms_teams_proxy = self.rule.get('ms_teams_proxy', None)
-        self.ms_teams_alert_summary = self.rule.get('ms_teams_alert_summary', None)
-        self.ms_teams_alert_fixed_width = self.rule.get('ms_teams_alert_fixed_width', False)
-        self.ms_teams_theme_color = self.rule.get('ms_teams_theme_color', '')
-        self.ms_teams_ca_certs = self.rule.get('ms_teams_ca_certs')
-        self.ms_teams_ignore_ssl_errors = self.rule.get('ms_teams_ignore_ssl_errors', False)
-        self.ms_teams_alert_facts = self.rule.get('ms_teams_alert_facts', '')
-        self.ms_teams_attach_kibana_discover_url = self.rule.get('ms_teams_attach_kibana_discover_url', False)
-        self.ms_teams_kibana_discover_title = self.rule.get('ms_teams_kibana_discover_title', 'Discover in Kibana')
-        self.ms_teams_attach_opensearch_discover_url = self.rule.get('ms_teams_attach_opensearch_discover_url', False)
-        self.ms_teams_opensearch_discover_title = self.rule.get('ms_teams_opensearch_discover_title', 'Discover in opensearch')
-
-    def format_body(self, body):
-        if self.ms_teams_alert_fixed_width:
-            body = body.replace('`', "'")
-            body = "```{0}```".format('```\n\n```'.join(x for x in body.split('\n'))).replace('\n``````', '')
-        return body
-
-    def populate_facts(self, matches):
-        alert_facts = []
-        for arg in self.ms_teams_alert_facts:
-            arg = copy.copy(arg)
-            matched_value = lookup_es_key(matches[0], arg['value'])
-            arg['value'] = matched_value if matched_value is not None else arg['value']
-            alert_facts.append(arg)
-        return alert_facts
-
-    def alert(self, matches):
-        body = self.create_alert_body(matches)
-        body = self.format_body(body)
-
-        title = self.create_title(matches)
-        summary = title if self.ms_teams_alert_summary is None else self.ms_teams_alert_summary
-        # post to Teams
-        headers = {'content-type': 'application/json'}
-
-        if self.ms_teams_ca_certs:
-            verify = self.ms_teams_ca_certs
-        else:
-            verify = not self.ms_teams_ignore_ssl_errors
-        if self.ms_teams_ignore_ssl_errors:
-            requests.packages.urllib3.disable_warnings()
-
-        # set https proxy, if it was provided
-        proxies = {'https': self.ms_teams_proxy} if self.ms_teams_proxy else None
-        payload = {
-            '@type': 'MessageCard',
-            '@context': 'http://schema.org/extensions',
-            'summary': summary ,
-            'title': title,
-            'sections': [{'text': body}],
-        }
-
-        if self.ms_teams_alert_facts != '':
-            payload['sections'][0]['facts'] = self.populate_facts(matches)
-
-        if self.ms_teams_theme_color != '':
-            payload['themeColor'] = self.ms_teams_theme_color
-
-        if self.ms_teams_attach_kibana_discover_url:
-            kibana_discover_url = lookup_es_key(matches[0], 'kibana_discover_url')
-            if kibana_discover_url:
-                payload['potentialAction'] = [
-                    {
-                        '@type': 'OpenUri',
-                        'name': self.ms_teams_kibana_discover_title,
-                        'targets': [
-                            {
-                                'os': 'default',
-                                'uri': kibana_discover_url,
-                            }
-                        ],
-                    }
-                ]
-        if self.ms_teams_attach_opensearch_discover_url:
-            opensearch_discover_url = lookup_es_key(matches[0], 'opensearch_discover_url')
-            if opensearch_discover_url:
-                payload['potentialAction'] = [
-                    {
-                        '@type': 'OpenUri',
-                        'name': self.ms_teams_opensearch_discover_title,
-                        'targets': [
-                            {
-                                'os': 'default',
-                                'uri': opensearch_discover_url,
-                            }
-                        ],
-                    }
-                ]
-
-        for url in self.ms_teams_webhook_url:
-            try:
-                response = requests.post(url, data=json.dumps(payload, cls=DateTimeEncoder),
-                                         headers=headers, proxies=proxies, verify=verify)
-                response.raise_for_status()
-            except RequestException as e:
-                raise EAException("Error posting to MS Teams: %s" % e)
-        elastalert_logger.info("Alert sent to MS Teams")
-
-    def get_info(self):
-        return {'type': 'ms_teams',
-                'ms_teams_webhook_url': self.ms_teams_webhook_url}