the elastalert2 is crashing if the query contains single quote

[alexku7]

How to properly escape special character, for example the single quote. What do I do wrong ? :)
Currently the elastalert is crashing with error:

The query string for example
query: 'kubernetes.container_name: analyzer AND log: "ERROR 'some error' something'

The error:

Traceback (most recent call last):
File "/usr/local/bin/elastalert", line 8, in
sys.exit(main())
File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 2155, in main
client = ElastAlerter(args)
File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 128, in init
self.rules = self.rules_loader.load(self.conf, self.args)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 162, in load
rule = self.load_configuration(rule_file, conf, args)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 223, in load_configuration
rule = self.load_yaml(filename)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 242, in load_yaml
loaded = self.get_yaml(filename)
File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 586, in get_yaml
return read_yaml(filename)
File "/usr/local/lib/python3.10/site-packages/elastalert/yaml.py", line 8, in read_yaml
return yaml.load(yamlContent, Loader=yaml.FullLoader)
File "/usr/local/lib/python3.10/site-packages/yaml/init.py", line 81, in load
return loader.get_single_data()
File "/usr/local/lib/python3.10/site-packages/yaml/constructor.py", line 49, in get_single_data
node = self.get_single_node()
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 36, in get_single_node
document = self.compose_document()
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 55, in compose_document
node = self.compose_node(None, None)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 82, in compose_node
node = self.compose_sequence_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 111, in compose_sequence_node
node.value.append(self.compose_node(node, index))
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/local/lib/python3.10/site-packages/yaml/composer.py", line 127, in compose_mapping_node
while not self.check_event(MappingEndEvent):
File "/usr/local/lib/python3.10/site-packages/yaml/parser.py", line 98, in check_event
self.current_event = self.state()
File "/usr/local/lib/python3.10/site-packages/yaml/parser.py", line 438, in parse_block_mapping_key
raise ParserError("while parsing a block mapping", self.marks[-1],
yaml.parser.ParserError: while parsing a block mapping
in "", line 14, column 10:
query: 'kubernetes.container_nam ...
^
expected , but found ''
in "", line 14, column 1653:
... cepted ObjectPath argument in 'input' parameter for flatten got ...

[nsano-rururu]

FAQ
https://elastalert2.readthedocs.io/en/latest/recipes/faq.html#how-to-write-a-query-filter-for-phrases-containing-spaces

[alexku7]

I update my answer. The github also removed the escape characters before the single quotes.
Now you can see the query as is including the escape characters. The bottom line- the error is still there :(

[nsano-rururu]

How to properly escape special character, for example the single quote. What do I do wrong ? :)

The writing is wrong. That's why it's an error.

[alexku7]

so maybe I am blind
what's wrong here ?

           query_string:
               query: 'kubernetes.container_name: analyzer AND log: "ERROR \'some error\' something"'

btw directly in kibana it's working

[portalthiago]

@alexku7
Works for me with this format:

query_string:
               query: "kubernetes.container_name: (analyzer) AND log: (ERROR *put any word here*)"

The use of * before or after can be heavy to cluster, so be very carefull with.

Please try this way!

best Regard.

[alexku7]

Thank you for reply.

that's the problem. I have a single quote which I must search literally .
SO I need something like this with 2 single quotes.
query_string:
query: 'kubernetes.container_name: analyzer AND log: "ERROR 'some error' something"'