Elastalert: terms does not support multiple fields

[prandelicious]

I'm getting this error message when using multiple fields in terms:

[terms] query does not support multiple fields

Here's my configuration:

es_host: 10.9.x.x
es_port: 9200
type: frequency
index: app-stream-*
num_events: 3
timeframe:
    minutes: 30
filter:
- terms:
    request: ["/auth/token"]
    response: ["400"]
alert:
- sns
sns_topic_arn: "arn:aws:sns:us-east-1:xxxxxx:opsgenie"

[pdscopes]

What version of ElasticSearch are you using? If it's >= 5 you'll been to AND terms together see https://elastalert.readthedocs.io/en/latest/recipes/writing_filters.html for more details.

[prandelicious]

Thank you! We're using 6.x. How do we AND terms together? Can you give an example?

[pdscopes]

Sure thing:

filter:
- bool:
    must:
    - terms:
        request: ["/auth/token"]
    - terms:
        response: ["400"]

[pdscopes]

For more information about it all see: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html

[naseemkullah]

Using ES7... have had more luck with query than term(s) lately

Maybe try:

- query:
    query_string:
      query: "request: /auth/token OR response: 400"