Elastalert: Error running your filter

[kasraorko]

Hello all,
my rules for an index does not get hit and I have the following error for test-rule:
Error running your filter:
TypeError("search() got multiple values for argument 'body'",)
INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
To send them but remain verbose, use --verbose instead.
1 rules loaded
INFO:apscheduler.scheduler:Adding job tentatively -- it will be properly scheduled when the scheduler starts

INFO:elastalert:Queried rule user deleted from cloud from 2020-01-25 07:22 UTC to 2020-01-26 23:22 UTC: 0 / 0 hits
INFO:elastalert:Queried rule user deleted from cloud from 2020-01-26 23:22 UTC to 2020-01-28 15:22 UTC: 0 / 0 hits
INFO:elastalert:Queried rule user deleted from cloud from 2020-01-28 15:22 UTC to 2020-01-30 07:22 UTC: 0 / 0 hits
INFO:elastalert:Queried rule user deleted from cloud from 2020-01-30 07:22 UTC to 2020-01-31 23:22 UTC: 0 / 0 hits
INFO:elastalert:Queried rule user deleted from cloud from 2020-01-31 23:22 UTC to 2020-02-02 15:22 UTC: 0 / 0 hits

and here is my rule

name: user deleted from cloud
type: any
index: cloud*
filter:
        - query:
            query_string:
                    query: "_type: doc"

[daichi703n]

quote your name

name: "user deleted from cloud"
type: any
index: cloud*
filter:
        - query:
            query_string:
                    query: "_type: doc" 

[kasraorko]

@daichi703n
thanks for correction
it didn't resolve anything
again I won't get any hits for this index
I also tested on common field which exists on each log but it doesn't get hit

[daichi703n]

@kasramtm Sorry, I misread the logs...
Does cloud* match some index-pattern? Please test with full index name? not cloud*, cloud-xxx(your index name).

index name is able to be check with curl http(s)://<elasticsearch>:<port>/_cat/indices

[kasraorko]

you really helped me!!
I used curl with my elastalert user and surprisingly got nothing !!
the problem is I am superuser in kibana and work properly with that index but my elastalert user didn't have permission on that index!
again thx for your quick help and reply