Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix the empty compound_query_key value #3017

Closed
wants to merge 1 commit into from
Closed

Fix the empty compound_query_key value #3017

wants to merge 1 commit into from

Commits on Oct 29, 2020

  1. Fix the empty compound_query_key value 

    With the existing codes, the rule['compound_compare_key'] is empty when we have only one query_key in the yaml config. And it breaks the custom_format function and hence throwing the exception.

ERROR:root:Traceback (most recent call last):
File "/usr/local/home/user/lib64/python3.6/site-packages/elastalert/elastalert.py", line 1458, in alert
return self.send_alert(matches, rule, alert_time=alert_time, retried=retried)
File "/usr/local/home/user/lib64/python3.6/site-packages/elastalert/elastalert.py", line 1527, in send_alert
enhancement.process(match)
File "/usr/local/home/user/lib64/python3.6/site-packages/elast_format/custom_format.py", line 117, in process
total_hit_real_key = match[self.rule['query_key']]
KeyError: 'query_key'

It seems that the rule['compound_query_key'] is required all time for various functions to be executed if there is at least one.

I have rolled back the change to the previous working one logic, it seems the deletion of rule['query_key'] is not necessary.
    @cfatduck
    cfatduck authored Oct 29, 2020
    Configuration menu
    Copy the full SHA
    a57d125 View commit details
    Browse the repository at this point in the history