If you go into the docker instance there will be 3 seperate versions of the code:
/ # find . -name alerts.py
./opt/elastalert/build/lib/elastalert/alerts.py
./opt/elastalert/elastalert/alerts.py
./usr/lib/python2.7/site-packages/elastalert-0.1.39-py2.7.egg/elastalert/alerts.py
The one that is actually running elastalert is: /opt/elastalert/elastalert/alerts.py