Range timestamp filter

[Nib0ort]

Hello
I want this rule to send me an email when elastalert detect at least 5 times in less 10 secondes a certain type of log containing a string of characters.
Here my rule, but I dont get email with 6 logs sent in less 10 secondes.
I'm using this command to send logs :
logger -t corosync is down

es_port: port
name: TEST
type: frequency
index: filebeat-*
filter:

query_string:
query: "message:"is down""
range:
"@timestamp":
gte: "now-10s/s"
timeframe:
seconds: 10
is_enabled: true
num_events: 5
alert:
"email"
alert_text_type: alert_text_only
alert_text: |
Link is down on host {0}
See full message : {1}
THIS IS A TEST MESSAGE
alert_text_args: ["host.name", "message"]
alert_subject: "[ElastAlert] PROXMOX : Link down alert"
from_addr: "addresse"
email:
"myemail"
smtp_host: smtp_host
smtp_port: smtp_port
smtp_auth_file: smtp_auth.yaml
smtp_ssl: false

Thanks for helping

[jertel]

Your alert looks like it has some formatting/indentation issues so it's difficult to read. But from what I do see I think the range block is not necessary. I suggest enabling DEBUG logging so you can see what is happening internally, such as what queries are being executed, how often, what the response is from Elasticsearch.

[Nib0ort]

Yup, that was the thing, thanks for your help :)