Heard the same about elastalert that it is difficult to manage. Any idea how much time/effort is spent per day/week/month to manage the elastalert rules and what level of expertise is required?