{"action":"created","issue":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/769","repository_url":"https://api.github.com/repos/Yelp/elastalert","labels_url":"https://api.github.com/repos/Yelp/elastalert/issues/769/labels{/name}","comments_url":"https://api.github.com/repos/Yelp/elastalert/issues/769/comments","events_url":"https://api.github.com/repos/Yelp/elastalert/issues/769/events","html_url":"https://github.com/Yelp/elastalert/issues/769","id":183994801,"number":769,"title":"frequency alert: not getting data of all events","user":{"login":"javatechy","id":10302110,"avatar_url":"https://avatars.githubusercontent.com/u/10302110?v=3","gravatar_id":"","url":"https://api.github.com/users/javatechy","html_url":"https://github.com/javatechy","followers_url":"https://api.github.com/users/javatechy/followers","following_url":"https://api.github.com/users/javatechy/following{/other_user}","gists_url":"https://api.github.com/users/javatechy/gists{/gist_id}","starred_url":"https://api.github.com/users/javatechy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javatechy/subscriptions","organizations_url":"https://api.github.com/users/javatechy/orgs","repos_url":"https://api.github.com/users/javatechy/repos","events_url":"https://api.github.com/users/javatechy/events{/privacy}","received_events_url":"https://api.github.com/users/javatechy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-19T15:26:35Z","updated_at":"2016-10-19T17:02:27Z","closed_at":null,"body":"I am using elastalert to send alerts on slack. but i am not getting the data of all related documents.\r\n\r\nMy alert code is:\r\n\r\n```\r\nname: INVALID TOKEN ERROR\r\ntype: frequency\r\nindex: index_name*\r\nnum_events: 10\r\ntimeframe:\r\n  hours: 1\r\nfilter:\r\n- query:\r\n    query_string:\r\n      query: \"error.code:X07\"\r\ngenerate_kibana_link: true\r\ntop_count_keys: [\"error.message\"]\r\nalert:\r\n- \"slack\"\r\nalert_subject: \"Invalid Token more than 10 in 1 hour ${0} ${1}\"\r\nalert_subject_args:\r\n- error.code\r\n- error.message\r\n- \"@timestamp\"\r\nalert_text: \"Invalid Token more than 10 in 1 hour\"\r\n#attach_related: true\r\nalert_text_args:\r\n- TIMESTAMP\r\n- \"@timestamp\"\r\nalert_text_type: alert_text_only\r\nslack:\r\nslack_webhook_url: https://hooks.slack.com/ddcdsjkcjdk\r\n\r\n```\r\ni am expecting all error messages in the alert but i am not getting it. Please help."},"comment":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/comments/254876099","html_url":"https://github.com/Yelp/elastalert/issues/769#issuecomment-254876099","issue_url":"https://api.github.com/repos/Yelp/elastalert/issues/769","id":254876099,"user":{"login":"Qmando","id":3246990,"avatar_url":"https://avatars.githubusercontent.com/u/3246990?v=3","gravatar_id":"","url":"https://api.github.com/users/Qmando","html_url":"https://github.com/Qmando","followers_url":"https://api.github.com/users/Qmando/followers","following_url":"https://api.github.com/users/Qmando/following{/other_user}","gists_url":"https://api.github.com/users/Qmando/gists{/gist_id}","starred_url":"https://api.github.com/users/Qmando/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Qmando/subscriptions","organizations_url":"https://api.github.com/users/Qmando/orgs","repos_url":"https://api.github.com/users/Qmando/repos","events_url":"https://api.github.com/users/Qmando/events{/privacy}","received_events_url":"https://api.github.com/users/Qmando/received_events","type":"User","site_admin":false},"created_at":"2016-10-19T17:02:27Z","updated_at":"2016-10-19T17:02:27Z","body":"Maybe you should uncomment ``attach_related``?"}}
{"actor":{"display_login":"Qmando"}}