{"action":"created","issue":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/1252","repository_url":"https://api.github.com/repos/Yelp/elastalert","labels_url":"https://api.github.com/repos/Yelp/elastalert/issues/1252/labels{/name}","comments_url":"https://api.github.com/repos/Yelp/elastalert/issues/1252/comments","events_url":"https://api.github.com/repos/Yelp/elastalert/issues/1252/events","html_url":"https://github.com/Yelp/elastalert/issues/1252","id":246263659,"node_id":"MDU6SXNzdWUyNDYyNjM2NTk=","number":1252,"title":"TransportError(400, u'search_phase_execution_exception', u'No mapping found for [alert_time] in order to sort on')","user":{"login":"anjan-cele","id":13432517,"node_id":"MDQ6VXNlcjEzNDMyNTE3","avatar_url":"https://avatars2.githubusercontent.com/u/13432517?v=4","gravatar_id":"","url":"https://api.github.com/users/anjan-cele","html_url":"https://github.com/anjan-cele","followers_url":"https://api.github.com/users/anjan-cele/followers","following_url":"https://api.github.com/users/anjan-cele/following{/other_user}","gists_url":"https://api.github.com/users/anjan-cele/gists{/gist_id}","starred_url":"https://api.github.com/users/anjan-cele/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anjan-cele/subscriptions","organizations_url":"https://api.github.com/users/anjan-cele/orgs","repos_url":"https://api.github.com/users/anjan-cele/repos","events_url":"https://api.github.com/users/anjan-cele/events{/privacy}","received_events_url":"https://api.github.com/users/anjan-cele/received_events","type":"User","site_admin":false},"labels":[{"id":151009109,"node_id":"MDU6TGFiZWwxNTEwMDkxMDk=","url":"https://api.github.com/repos/Yelp/elastalert/labels/bug","name":"bug","color":"fc2929","default":true},{"id":151009112,"node_id":"MDU6TGFiZWwxNTEwMDkxMTI=","url":"https://api.github.com/repos/Yelp/elastalert/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-07-28T07:13:55Z","updated_at":"2018-11-21T15:15:17Z","closed_at":null,"author_association":"NONE","body":"Hi @Qmando \r\n\r\nWhen I am running example_frequency.yaml rule. I am getting following error:\r\n\r\nERROR:root:Error finding recent pending alerts: TransportError(400, u'search_phase_execution_exception', u'No mapping found for [alert_time] in order to sort on') {'sort': {'alert_time': {'order': 'asc'}}, 'query': {'bool': {'filter': {'range': {'alert_time': {'to': '2017-07-25T15:43:52.149157Z', 'from': '2017-07-23T15:43:52.149125Z'}}}, 'must': {'query_string': {'query': '!_exists_:aggregate_id AND alert_sent:false'}}}}}\r\nTraceback (most recent call last):\r\n  File \"/home/watchman/elastalert/elastalert/elastalert.py\", line 1387, in find_recent_pending_alerts\r\n    size=1000)\r\n  File \"build/bdist.linux-x86_64/egg/elasticsearch/client/utils.py\", line 73, in _wrapped\r\n    return func(*args, params=params, **kwargs)\r\n  File \"build/bdist.linux-x86_64/egg/elasticsearch/client/__init__.py\", line 623, in search\r\n    doc_type, '_search'), params=params, body=body)\r\n  File \"build/bdist.linux-x86_64/egg/elasticsearch/transport.py\", line 312, in perform_request\r\n    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)\r\n  File \"build/bdist.linux-x86_64/egg/elasticsearch/connection/http_requests.py\", line 90, in perform_request\r\n    self._raise_error(response.status_code, raw_data)\r\n  File \"build/bdist.linux-x86_64/egg/elasticsearch/connection/base.py\", line 125, in _raise_error\r\n    raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)\r\nRequestError: TransportError(400, u'search_phase_execution_exception', u'No mapping found for [alert_time] in order to sort on')\r\n\r\nWhen I am running my elastalert_status thru following command, it is giving output as :\r\ncurl amdc2webl24:9200/elastalert_status/_mapping\r\n\r\n\r\n{\"elastalert_status\":{\"mappings\":{\"elastalert_error\":{\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"data\":{\"properties\":{\"rule\":{\"type\":\"text\",\"fields\":{\"keyword\":{\"type\":\"keyword\",\"ignore_above\":256}}}}},\"message\":{\"type\":\"text\",\"fields\":{\"keyword\":{\"type\":\"keyword\",\"ignore_above\":256}}},\"traceback\":{\"type\":\"text\",\"fields\":{\"keyword\":{\"type\":\"keyword\",\"ignore_above\":256}}}}},\"elastalert_status\":{\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"endtime\":{\"type\":\"date\"},\"hits\":{\"type\":\"long\"},\"matches\":{\"type\":\"long\"},\"rule_name\":{\"type\":\"text\",\"fields\":{\"keyword\":{\"type\":\"keyword\",\"ignore_above\":256}}},\"starttime\":{\"type\":\"date\"},\"time_taken\":{\"type\":\"float\"}}}}}}\r\n\r\nIf I am trying to recreate the index by - elastalert-create-index then getting following error 👍 \r\n\r\nTraceback (most recent call last):\r\n  File \"/usr/local/bin/elastalert-create-index\", line 11, in <module>\r\n    load_entry_point('elastalert', 'console_scripts', 'elastalert-create-index')()\r\n  File \"/usr/local/lib/python3.5/dist-packages/pkg_resources/__init__.py\", line 563, in load_entry_point\r\n    return get_distribution(dist).load_entry_point(group, name)\r\n  File \"/usr/local/lib/python3.5/dist-packages/pkg_resources/__init__.py\", line 2651, in load_entry_point\r\n    return ep.load()\r\n  File \"/usr/local/lib/python3.5/dist-packages/pkg_resources/__init__.py\", line 2305, in load\r\n    return self.resolve()\r\n  File \"/usr/local/lib/python3.5/dist-packages/pkg_resources/__init__.py\", line 2311, in resolve\r\n    module = __import__(self.module_name, fromlist=['__name__'], level=0)\r\n  File \"/home/watchman/elastalert/elastalert/create_index.py\", line 12, in <module>\r\n    from auth import Auth\r\nImportError: No module named 'auth'\r\n\r\n\r\nI think index is creating for Python 3.5, If so then how can I map alert_time in index i.e elastalert_status for Python 2.7. Do I need to uninstall Python 3.5 which I can't because other applications need Python 3.5.\r\n\r\nPlease suggest.\r\nThank you."},"comment":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/comments/440700493","html_url":"https://github.com/Yelp/elastalert/issues/1252#issuecomment-440700493","issue_url":"https://api.github.com/repos/Yelp/elastalert/issues/1252","id":440700493,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MDcwMDQ5Mw==","user":{"login":"pastechecker","id":39824569,"node_id":"MDQ6VXNlcjM5ODI0NTY5","avatar_url":"https://avatars2.githubusercontent.com/u/39824569?v=4","gravatar_id":"","url":"https://api.github.com/users/pastechecker","html_url":"https://github.com/pastechecker","followers_url":"https://api.github.com/users/pastechecker/followers","following_url":"https://api.github.com/users/pastechecker/following{/other_user}","gists_url":"https://api.github.com/users/pastechecker/gists{/gist_id}","starred_url":"https://api.github.com/users/pastechecker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pastechecker/subscriptions","organizations_url":"https://api.github.com/users/pastechecker/orgs","repos_url":"https://api.github.com/users/pastechecker/repos","events_url":"https://api.github.com/users/pastechecker/events{/privacy}","received_events_url":"https://api.github.com/users/pastechecker/received_events","type":"User","site_admin":false},"created_at":"2018-11-21T15:15:17Z","updated_at":"2018-11-21T15:15:17Z","author_association":"NONE","body":"What if I do not have @timestamp mappings in my data because I have chosen to index using a custom field and it is not called timestamp but \"mytime\"?\r\n\r\nI am running Kibana + Docker on Elastic/Kibana 6.4.2\r\nelastalert_error - {'message': \"Error running query: RequestError(400, u'search_phase_execution_exception', u'No mapping found for [@timestamp] in order to sort on')"}}
{"actor":{"display_login":"pastechecker"}}