{"action":"closed","issue":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/850","repository_url":"https://api.github.com/repos/Yelp/elastalert","labels_url":"https://api.github.com/repos/Yelp/elastalert/issues/850/labels{/name}","comments_url":"https://api.github.com/repos/Yelp/elastalert/issues/850/comments","events_url":"https://api.github.com/repos/Yelp/elastalert/issues/850/events","html_url":"https://github.com/Yelp/elastalert/issues/850","id":197778253,"number":850,"title":"No document to writeback index","user":{"login":"siyuanpeng","id":24800530,"avatar_url":"https://avatars.githubusercontent.com/u/24800530?v=3","gravatar_id":"","url":"https://api.github.com/users/siyuanpeng","html_url":"https://github.com/siyuanpeng","followers_url":"https://api.github.com/users/siyuanpeng/followers","following_url":"https://api.github.com/users/siyuanpeng/following{/other_user}","gists_url":"https://api.github.com/users/siyuanpeng/gists{/gist_id}","starred_url":"https://api.github.com/users/siyuanpeng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/siyuanpeng/subscriptions","organizations_url":"https://api.github.com/users/siyuanpeng/orgs","repos_url":"https://api.github.com/users/siyuanpeng/repos","events_url":"https://api.github.com/users/siyuanpeng/events{/privacy}","received_events_url":"https://api.github.com/users/siyuanpeng/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-28T00:57:59Z","updated_at":"2016-12-29T19:43:11Z","closed_at":"2016-12-29T19:43:11Z","body":"I tested my config and rule using \"elastalert-test-rule\". But when I run elastalert, it doesn't seems the filter is hit. Is it caused by my config/rule?\r\n\r\nHere is the output of \"elastalert-test-rule\"\r\n````\r\nWould have written the following documents to writeback index (default is elastalert_status):\r\n\r\nsilence - {'rule_name': 'Test', '@timestamp': datetime.datetime(2016, 12, 28, 0, 36, 2, 831320, tzinfo=tzutc()), 'exponent': 0, 'until': datetime.datetime(2016, 12, 28, 0, 37, 2, 831313, tzinfo=tzutc())}\r\n\r\nelastalert_status - {'hits': 46, 'matches': 46, '@timestamp': datetime.datetime(2016, 12, 28, 0, 36, 2, 836233, tzinfo=tzutc()), 'rule_name': 'Test', 'starttime': datetime.datetime(2016, 12, 27, 0, 36, 2, 723051, tzinfo=tzutc()), 'endtime': datetime.datetime(2016, 12, 28, 0, 36, 2, 723051, tzinfo=tzutc()), 'time_taken': 0.11143803596496582}\r\n````\r\n\r\npython elastalert/elastalert.py --verbose  --rule my_rule/example_frequency.yaml  --config config.yaml.example --es_debug_trace /home/tmp/estrace\r\n\r\n\r\n```\r\nINFO:elastalert:Starting up\r\nINFO:elastalert:Sleeping for 9 seconds\r\nINFO:elastalert:Sleeping for 9 seconds\r\nINFO:elastalert:Sleeping for 9 seconds\r\nINFO:elastalert:Sleeping for 9 seconds\r\nINFO:elastalert:Sleeping for 9 seconds\r\nINFO:elastalert:Sleeping for 9 seconds\r\nINFO:elastalert:Sleeping for 9 seconds\r\n```\r\n\r\nHere is my rule \r\n\r\n```\r\n# Alert when the rate of events exceeds a threshold\r\n\r\n# (Optional)\r\n# Elasticsearch host\r\n#es_host: localhost\r\n\r\n# (Optional)\r\n# Elasticsearch port\r\n#es_port: 17416\r\n\r\n# (OptionaL) Connect with SSL to Elasticsearch\r\n#use_ssl: True\r\n\r\n# (Optional) basic-auth username and password for Elasticsearch\r\n#es_username: someusername\r\n#es_password: somepassword\r\n\r\n# (Required)\r\n# Rule name, must be unique\r\nname: Test\r\n\r\n# (Required)\r\n# Type of alert.\r\n# the frequency rule type alerts when num_events events occur with timeframe time\r\ntype: frequency\r\n\r\n# (Required)\r\n# Index to search, wildcard supported\r\nindex: log\r\n\r\n# (Required, frequency specific)\r\n# Alert when this many documents matching the query occur within a timeframe\r\nnum_events: 1\r\n\r\n# (Required, frequency specific)\r\n# num_events must occur within this amount of time to trigger an alert\r\ntimeframe:\r\n  hours: 1\r\n\r\n# (Required)\r\n# A list of Elasticsearch filters used for find events\r\n# These filters are joined with AND and nested in a filtered query\r\n# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html\r\nfilter:\r\n- term:\r\n     tag : \"ssh\"\r\n\r\n# (Required)\r\n# The alert is use when a match is found\r\nalert:\r\n- \"email\"\r\n\r\n# (required, email specific)\r\n# a list of email addresses to send alerts to\r\nemail:\r\n- \"someemail@somedomain.com\"\r\n\r\ntimestamp_field: \"timestamp\"\r\n\r\n```\r\n\r\nMy Config\r\n\r\n\r\n```\r\n# This is the folder that contains the rule yaml files\r\n# Any .yaml file will be loaded as a rule\r\nrules_folder: my_rule\r\n\r\n# How often ElastAlert will query Elasticsearch\r\n# The unit can be anything from weeks to seconds\r\nrun_every:\r\n  seconds: 10\r\n#   minutes: 10\r\n# ElastAlert will buffer results from the most recent\r\n# period of time, in case some log sources are not in real time\r\nbuffer_time:\r\n#  seconds: 10\r\n   minutes: 45\r\n# The Elasticsearch hostname for metadata writeback\r\n# Note that every rule can have its own Elasticsearch host\r\nes_host: 127.0.0.1\r\n\r\n# The Elasticsearch port\r\nes_port: 17416\r\n\r\n# Optional URL prefix for Elasticsearch\r\n#es_url_prefix: elasticsearch\r\n\r\n# Connect with TLS to Elasticsearch\r\n#use_ssl: True\r\n\r\n# Verify TLS certificates\r\n#verify_certs: True\r\n\r\n# GET request with body is the default option for Elasticsearch.\r\n# If it fails for some reason, you can pass 'GET', 'POST' or 'source'.\r\n# See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport\r\n# for details\r\n#es_send_get_body_as: GET\r\n\r\n# Option basic-auth username and password for Elasticsearch\r\n#es_username: someusername\r\n#es_password: somepassword\r\n\r\n# The index on es_host which is used for metadata storage\r\n# This can be a unmapped index, but it is recommended that you run\r\n# elastalert-create-index to set a mapping\r\nwriteback_index: elastalert_stat\r\n# elastalert_status\r\n\r\n# If an alert fails for some reason, ElastAlert will retry\r\n# sending the alert until this time period has elapsed\r\nalert_time_limit:\r\n  days: 2\r\n\r\n```\r\n\r\nThe es trace just simply queries the index \r\n```\r\n\r\ncurl -XGET 'http://localhost:9200/elastalert_stat/elastalert/_search?pretty&size=1000' -d '{\r\n  \"filter\": {\r\n    \"range\": {\r\n      \"alert_time\": {\r\n        \"from\": \"2016-12-26T00:39:39.644455Z\",\r\n        \"to\": \"2016-12-28T00:39:39.644482Z\"\r\n      }\r\n    }\r\n  },\r\n  \"query\": {\r\n    \"query_string\": {\r\n      \"query\": \"!_exists_:aggregate_id AND alert_sent:false\"\r\n    }\r\n  },\r\n  \"sort\": {\r\n    \"alert_time\": {\r\n      \"order\": \"asc\"\r\n    }\r\n  }\r\n```"}}
{"actor":{"display_login":"siyuanpeng"}}