elastalert是否适用于ElasticSearch 6

Question

有一个与elasticsearch 5.6一起使用的弹性码头图像（https://hub.docker.com/r/ivankrizsan/elastalert/），改为使用ElasticSearch 6.1（没有索引）的测试环境，现在得到

Creating Elastalert index in Elasticsearch...
Traceback (most recent call last):
  File "/usr/bin/elastalert-create-index", line 11, in <module>
    load_entry_point('elastalert', 'console_scripts', 'elastalert-create-index')()
  File "/opt/elastalert/elastalert/create_index.py", line 153, in main
    es.indices.put_mapping(index=index, doc_type='elastalert', body=es_mapping)
  File "build/bdist.linux-x86_64/egg/elasticsearch/client/utils.py", line 73, in _wrapped
  File "build/bdist.linux-x86_64/egg/elasticsearch/client/indices.py", line 282, in put_mapping
  File "build/bdist.linux-x86_64/egg/elasticsearch/transport.py", line 312, in perform_request
  File "build/bdist.linux-x86_64/egg/elasticsearch/connection/http_requests.py", line 90, in perform_request
  File "build/bdist.linux-x86_64/egg/elasticsearch/connection/base.py", line 125, in _raise_error
elasticsearch.exceptions.RequestError: TransportError(400, u'mapper_parsing_exception', u'No handler for type [string] declared on field [aggregate_id]')

Answer 1

截至目前，elastalert不支持弹性搜索6.0开箱即用。以下是跟踪问题的github：https://github.com/Yelp/elastalert/issues/1399上的未解决问题。在https://github.com/Yelp/elastalert/pull/1426也提到了一次步行。

Answer 2

请升级到最新版本的elastalert。我使用Elasticsearch 6.2与ElastAlert 0.1.29，他们正常工作。