ES Version revert to 7.0.0

[robrankin]

As noted in Yelp/elastalert#2725 more recent versions of elasticsearch pip package causes errors. Started seeing these errors when moving to the newest release here.

Error:

deprecated_search() got an unexpected keyword argument 'headers'

I see this was updated in 45237cc however from my experience it probably needs to be reverted for now.

Also a slight change to the Dockerfile. If someones already cloned the repo, in order to work on the Dockerfile, having it RUN git clone again is confusing.

[nsano-rururu]

@robrankin

In the rule I created, there is no problem in the state of elasticsearch>=7.0.0,<8.0.0, but does the rule I create cause a problem?
If there is a problem with the rule settings, I think there is no choice but to undo it.

[robrankin]

In the rule I created, there is no problem in the state of elasticsearch>=7.0.0,<8.0.0, but does the rule I create cause a problem?

In my testing, the current version 7.12.0 causes the error, as mentioned. Downgrading back to 7.0.0 stops the errors.

[nsano-rururu]

@robrankin

It's not a problem, but if there is a problem depending on the environment, I'm in favor of returning it.
As a reminder, does that mean that the current latest and latest elaticsearch library version of jertel/elastalert2, not yelp/elastalert, is a problem with the current settings and is no longer a problem with 7.0.0? ..

[robrankin]

It's not a problem, but if there is a problem depending on the environment, I'm in favor of returning it.
As a reminder, does that mean that the current latest and latest elaticsearch library version of jertel/elastalert2, not yelp/elastalert, is a problem with the current settings and is no longer a problem with 7.0.0? ..

Apologies, yes this problem is evident with elastalert2, specifically using the Docker container.

[nsano-rururu]

@robrankin

thank you for your answer.

[nsano-rururu]

doc_type If you continue to support what you specify,
It seems that it is necessary to fix it to elasticsearch == 7.
Looking at the past issues of elasticsearch-py, there was a comment that "It has been deleted in as many places as possible (or it is the default kwarg)", so the newer the version, the more it corresponds. Is being done a lot. Is it because doc_type is completely deleted in elasticsearch 8?

[jertel]

The Dockerfile needed to clone the repo since Docker Hub created the builds, and it doesn't have a local copy of the repo prior to running the docker build command.

I agree, though, that it is inefficient for us users. So I've disabled automated builds on Docker Hub and instead activated a new GitHub action to perform the image build and push, and removed the git clone from the Dockerfile. So this will resolve your concern, but you'll need to remove your Dockerfile changes from this PR to avoid merge conflicts with the changes I pushed this morning.

[robrankin]

Merge conflicts gone.

[jertel]

I'll open an issue for the obsolete doc_type field. That is going to be a blocker when ES8 is released.