How to write my rule config correctly?

[Aniwer]

how to use https in rule config

es_host: https://elasticsearch-szidc.mmtwork.com
es_port: 8080

# This is verified by kibana
filter:
- query:
    query_string:
      query: "log:error or caused by"
- query:
    query_string:
      query: "kubernetes.namespace_name.keyword:dxp-job"

Error

WARNING:elasticsearch:GET http://https://elasticsearch-szidc.mmtwork.com:8080/_search/scroll?scroll=30s [status:400 request:0.227s]
ERROR:elastalert:Error running query: RequestError(400, 'action_request_validation_exception', 'Validation Failed: 1: scrollId is missing;')

[ferozsalam]

Instead of https://elasticsearch-szidc.mmtwork.com, use elasticsearch-szidc.mmtwork.com as your es_host value.

[mashaikx13]

Hi @ferozsalam. I am currently writing rules for the hive and just trying to have some custom fields but I'm having a problem writing. What I am doing is trying to do is to get agent.name field from elasticsearch but seems like I am making syntax errors in rules. It would be helpful if you can share any relevant info or piece of advice. Here are my hive configs

hive_alert_config:
  customFields:
    - name: Agent Name
      type: string
      value: agent.name

[jertel]

@mashaikx13 Please review the pinned Discussion #11. This should not have been posted to this old and unrelated discussion.

[mashaikx13]

I have followed your guidelines and have posted a question in discussion. I will be grateful if you can help with the problem of customFields. Thanks

[jertel]

Please review the docs: use_ssl