python - 运行 python 命令时在 ES 版本 7.3.2 上使用 elastalert 时出现问题

Question

运行查询时出错：RequestError(400, 'parsing_exception', "[term] 查询不支持多个字段，找到 [some_field] 和 [timestamp_format_expr]")

# (Required)
# A list of Elasticsearch filters used for find events

 filter:
 - term:
    some_field: "some_value"

Answer 1

You are not using filter query correct. This is how you can filter by more field terms:

GET <YOUR_INDEX>/_search
{
    "query": {
        "bool": {
            "filter": [
                {"term": {"one_field" : "one_value"}},
                {"term": {"another_field" : "another_value"}}
            ]
        }
    }
}