-
I have an elastalert2 instance querying an elastic cloud stack, once I try to test alerts with a simple rule, I'm getting 0 hits contiously followed by this warning: WARNING:elasticsearch:DELETE https://[es_host]/_search/scroll [status:404 request:0.016s] Even having matching events (checked in UI) I'm getting 0 hits and no alert is generated. The same setup is working properly from a different machine, both of them using elastalert 0.2.15 but never running at the same time. What I`ve tried:
Do you have any clue on this? I've seen the same problem in other post but related with two instances running at the same time |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
To clarify:
|
Beta Was this translation helpful? Give feedback.
It seems like the two ElastAlert instances are either accessing different Elasticsearch clusters, or they have different access rights. For example, the ElastAlert instance that isn't working perhaps doesn't have read/write/scroll/etc rights to the cluster, but the working ElastAlert instance does have those privileges.
I can't think of any other reason why identical queries originating from alternate sources would see different results.
If I were in your shoes I would use tcpdump or wireshark to trace the packets and confirm that they are arriving from both ElastAlert instances.