Enables querying the source index and correlate with ElastAlert.
Enables querying the source index and correlate with ElastAlert.

Add support to put the match in the root ElastAlert document. For example, if your query_key is source.ip, source.ip will also be present in the ElastAlert index.

Yelp/elastalert