title: Elastalert simplified multiple rules in one file
body: <p>I'm writing <code>Elastalart</code> rules for heartbeat i.e if service or machine are/is down, I should get notified. Right now I can create one rule for service per one file like below.</p>
  
  <pre><code>name: My Alert
  type: frequency
  index: heartbeat-*
  num_events: 5
  timeframe:
      minutes: 2
  
  filter:
  - query:
      query_string:
        query: "url.domain: MY_LOCALHOST01.local AND monitor.status: down"
  
  alert:
  - "email"
  
  email:
  - "user@example.in"
  </code></pre>
  
  <p>Is there any way, can I specify multiple rules??... I can specify multiple filter like below</p>
  
  <pre><code>...
  filter:
  - query: # Filter 1
      query_string:
        query: "url.domain: MY_LOCALHOST01.local AND monitor.status: down"
  
  - query: # Filter 2
      query_string:
        query: "url.domain: MY_LOCALHOST02.local AND monitor.status: down"
  ...
  </code></pre>
  
  <p>But Elatalert consider <code>num_events</code> on ALL filters. For example, I dont want to get alert for situation like <code>Filter 1</code> got 3 hits and <code>Filter 2</code> got 2 hits i.e 3+2=5 which is equal to <code>num_events</code>.</p>
  
  <p>So, is there any ways the <code>num_events</code> should check per filter? like if <code>Filter 1</code> got 5 hits and <code>Filter 2</code> got 3 hits, then I can confirm <code>MY_LOCALHOST01</code> is really DOWN and send alert. </p>
  
  <p>I don't want multiple files. It would be hard to manage/modify.</p>