Elasticsearch 8.0.0 - ElastAlert Errors

[ar3diu]

Hi,

I just upgraded a local cluster to Elasticsearch 8.0.0 and checked if the ElastAlert2 rules (I'm using the docker image) still function. I have two flatline rules that detect when data sources stop sending logs to Elasticsearch. Both worked well and still do while using ES 7.x.
Now, after upgraded to 8.x I get the following errors:

WARNING:elasticsearch:GET https://localhost:9200/logs-*/_doc/_search?ignore_unavailable=true&size=0 [status:400 request:0.116s]
elastalert    
ERROR:elastalert:Error running terms query: RequestError(400, 'illegal_argument_exception', 'request [/logs-*/_doc/_search] contains unrecognized parameters: [ignore_unavailable], [size]')

Any workaround idea would be very helpful.

[nsano-rururu]

It doesn't work because it doesn't support it yet. It doesn't say that the document also supports it.

[nsano-rururu]

#92

[ar3diu]

Thank you very much for the clarifications!