{"action":"opened","issue":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/1662","repository_url":"https://api.github.com/repos/Yelp/elastalert","labels_url":"https://api.github.com/repos/Yelp/elastalert/issues/1662/labels{/name}","comments_url":"https://api.github.com/repos/Yelp/elastalert/issues/1662/comments","events_url":"https://api.github.com/repos/Yelp/elastalert/issues/1662/events","html_url":"https://github.com/Yelp/elastalert/issues/1662","id":317201967,"number":1662,"title":"ES v5 vs v6 .raw vs .keyword","user":{"login":"stevegszabo","id":10410711,"avatar_url":"https://avatars1.githubusercontent.com/u/10410711?v=4","gravatar_id":"","url":"https://api.github.com/users/stevegszabo","html_url":"https://github.com/stevegszabo","followers_url":"https://api.github.com/users/stevegszabo/followers","following_url":"https://api.github.com/users/stevegszabo/following{/other_user}","gists_url":"https://api.github.com/users/stevegszabo/gists{/gist_id}","starred_url":"https://api.github.com/users/stevegszabo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevegszabo/subscriptions","organizations_url":"https://api.github.com/users/stevegszabo/orgs","repos_url":"https://api.github.com/users/stevegszabo/repos","events_url":"https://api.github.com/users/stevegszabo/events{/privacy}","received_events_url":"https://api.github.com/users/stevegszabo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-24T12:25:54Z","updated_at":"2018-04-24T12:25:54Z","closed_at":null,"author_association":"NONE","body":"When NewTermsRule generates a listing of known terms for a specific field it uses either .raw or .keyword depending on if we run v5 or v6 of ES. Using v6 EA was not storing the correct term value unless we changed add_raw_postfix to use .keyword "}}
{"actor":{"display_login":"stevegszabo"}}