Elastalert: Not able to hitsMy rule is not getting any hits..

Created on 15 May 2019 · 2Comments · Source: Yelp/elastalert

[root@flaolprvd04 example_rules]# elastalert-test-rule --config config.yaml example_single_metric_agg.yaml
/usr/lib/python2.7/site-packages/elastalert-0.1.39-py2.7.egg/elastalert/config.py:31: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.
rule_schema = jsonschema.Draft4Validator(yaml.load(open(os.path.join(os.path.dirname(__file__), 'schema.yaml'))))
/usr/lib/python2.7/site-packages/elastalert-0.1.39-py2.7.egg/elastalert/test_rule.py:339: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.
conf = yaml.load(fh)
Successfully loaded Metricbeat Memory Spike Rule

WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8
WARNING:root:doc_type has been deprecated since elasticsearch version 6 and will be completely removed in 8

Would have written the following documents to writeback index (default is elastalert_status):

elastalert_status - {'hits': 0, 'matches': 0, '@timestamp': datetime.datetime(2019, 5, 15, 5, 52, 24, 171147, tzinfo=tzutc()), 'rule_name': 'Metricbeat Memory Spike Rule', 'starttime': datetime.datetime(2019, 5, 14, 5, 52, 24, 31961, tzinfo=tzutc()), 'endtime': datetime.datetime(2019, 5, 15, 5, 52, 24, 31961, tzinfo=tzutc()), 'time_taken': 0.13446712493896484}

Source