Does elastalert work with ElasticSearch 6

Question

Have an elastalert docker image (https://hub.docker.com/r/ivankrizsan/elastalert/) that worked with elasticsearch 5.6, changed to a test environment with ElasticSearch 6.1 (no index) and now get

Creating Elastalert index in Elasticsearch...
Traceback (most recent call last):
  File "/usr/bin/elastalert-create-index", line 11, in <module>
    load_entry_point('elastalert', 'console_scripts', 'elastalert-create-index')()
  File "/opt/elastalert/elastalert/create_index.py", line 153, in main
    es.indices.put_mapping(index=index, doc_type='elastalert', body=es_mapping)
  File "build/bdist.linux-x86_64/egg/elasticsearch/client/utils.py", line 73, in _wrapped
  File "build/bdist.linux-x86_64/egg/elasticsearch/client/indices.py", line 282, in put_mapping
  File "build/bdist.linux-x86_64/egg/elasticsearch/transport.py", line 312, in perform_request
  File "build/bdist.linux-x86_64/egg/elasticsearch/connection/http_requests.py", line 90, in perform_request
  File "build/bdist.linux-x86_64/egg/elasticsearch/connection/base.py", line 125, in _raise_error
elasticsearch.exceptions.RequestError: TransportError(400, u'mapper_parsing_exception', u'No handler for type [string] declared on field [aggregate_id]')

When I run: curl -XGET "10.10.10.185:9200/elastalert_status/elastalert/…" Then I get: "{"took":0,"timed_out":false,"_shards":{"total":5,"successful":5,"skipped":0,"failed":0},"hits":{"total":0,"max_score":null,"hits":[]}}" — david
or when starting ElastAlert: "2017-12-19 15:46:43,392 DEBG 'elastalert' stderr output: ERROR:root:Error finding recent pending alerts: TransportError(400, u'parsing_exception', u'Unknown key for a START_OBJECT in [filter].') {'filter': {'range': {'alert_time': {'to': '2017-12-19T15:46:43.385087Z', 'from': '2017-12-17T15:46:43.384974Z'}}}, 'query': {'query_string': {'query': '!_exists_:aggregate_id AND alert_sent:false'}}, 'sort': {'alert_time': {'order': 'asc'}}} ... 400, u'parsing_exception', u'Unknown key for a START_OBJECT in [filter].')" — david

user2859314 user2859314 · Accepted Answer · 2018-01-02T16:48:15

As of now, elastalert does not support for elasticsearch 6.0 out of the box. Here is the open issue on github: https://github.com/Yelp/elastalert/issues/1399 that tracks the issue. A walk-around is also mentioned in https://github.com/Yelp/elastalert/pull/1426.

Does elastalert work with ElasticSearch 6

2 Answers