TypeError("search() got multiple values for argument 'body'",)

[LazarenkoA]

Hi. I run the config test with the elastalert-test-rule command, get error

Error running your filter:
TypeError("search() got multiple values for argument 'body'",)
1 rules loaded
INFO:apscheduler.scheduler:Adding job tentatively -- it will be properly scheduled when the scheduler starts
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:23 UTC to 2020-05-15 11:24 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:24 UTC to 2020-05-15 11:25 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:25 UTC to 2020-05-15 11:26 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:26 UTC to 2020-05-15 11:27 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:27 UTC to 2020-05-15 11:28 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:28 UTC to 2020-05-15 11:29 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:29 UTC to 2020-05-15 11:30 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:30 UTC to 2020-05-15 11:31 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:31 UTC to 2020-05-15 11:32 UTC: 0 / 0 hits
INFO:elastalert:Queried rule rmngr_error_spike from 2020-05-15 11:32 UTC to 2020-05-15 11:33 UTC: 0 / 0 hits
......................................

The filter in a config:

filter:
- bool:
    filter:
    - bool:
        should:
        - query_string:
            fields:
            - Descr
            query: "*RMngrCalls*"
        minimum_should_match: 1
    - bool:
        should:
        - bool:
            should:
            - query_string:
                fields:
                - Descr
                query: "*onBeginTransaction*"
            minimum_should_match: 1
        - bool:
            should:
            - query_string:
                fields:
                - Descr
                query: "*onCommitTransaction*"
            minimum_should_match: 1
        minimum_should_match: 1
- match_phrase:
    type:
      query: log1c-excp

If take this filter and convert to json and execute to elk console, everything works, why error?

[nickbabkin]

I would try removing minimum_should_match clauses first.

[LazarenkoA]

I would try removing minimum_should_match clauses first.

It hasn't helped. Even if you simplify the filter, there is still the error

filter:
- match_phrase:
    type:
      query: log1c-excp

[nickbabkin]

Can you post a complete rule file?

[LazarenkoA]

Can you post a complete rule file?

name: rmngr_error_spike
type: spike
index: log1c-*

timeframe:
  hours: 2

threshold_cur: 100
#threshold_ref: 5

spike_height: 5

spike_type: "up"

filter:
- match_phrase:
    type:
      query: log1c-excp


alert:
  - "command"

command:
  - "/opt/elastalert/alerts/send_alert.sh"
  - "❗  Exception on %(host.name)s, %(p:processName)s, User: %(Usr)s"

[LazarenkoA]

Apparently this is an informational message, because roles work

[LazarenkoA]

it seems the reason is
#2725 (comment)