Elastalert: "Negation, and, or" is not working.

[kuzm1ch]

I have faced issue with "Negation, and, or" in my rule. For testing purposes I choose filter from docs i https://elastalert.readthedocs.io/en/latest/recipes/writing_filters.html in my rule and received error.

filter:
- or:
    - term:
        field: "value"
    - wildcard:
        field: "foo*bar"
    - and:
        - not:
            term:
              field: "value"
        - not:
            term:
              _type: "something"

command: python -m elastalert.elastalert --verbose --rule test.alert.yml --config config.yml
...
ERROR:root:Error running query: TransportError(400, u'parsing_exception', u'[or] query malformed, no start_object after query name')

Could you please check it.

[Qmando]

This is a known issue with newer versions of Elasticsearch. You'll need to use query strings:

- query_string:
     query: "(field: value OR field: foo*bar) AND NOT field: value AND NOT _type: something"