[elastalert2]---WARNING:elasticsearch:DELETE https://es-host:9200/_search/scroll

[paperdu]

Unfortunately, I had the same problem.

I've read posts about similar problems, but none seem to include a solution

As author jertel says, this problem may be caused by two different elastalert2 instances querying the same scroll

However, I have the impression that only one instance is running, so why is this happening

And this problem still exists after I re-installed elasticsearch and elastalert2, how do I find out the different instances of elastalert that are running?

[paperdu]

When my alarm rule was running, elastalert2 failed to issue warnings because of this problem, even though I found the alert keyword in kibana

[jertel]

You could shutdown the ElastAlert 2 instance you are seeing with the error, and then monitor the elastalert-* indices via Kibana to see if any updates occur on those indices.

[paperdu]

Oh, I misunderstood you earlier
I found the index and found that it had not been updated

[paperdu]

I have found a solution to the problem myself
In logstash I set up to generate an index every day: ll%{+yyyy.MM.dd}
but it seems that elastalert does not work for this generation mode
After I changed logstash's index to a fixed one, elastalert resumed working

[paperdu]

thank you for your answer ^ ^

[sontn1988]

Hi, I have some issue with Paperdu
I have a lot of index, but i can't remove them
ElasticAlert 2 can run with my ELK 6 but when i update it to 8.8.0
It got this issue and elasticalert2 can't run anymore

This is status of my elasticalert2 in ELK
Can you give me some idea to fix it

yellow open elastalert_status_status  KeK1eLl6R8-ScGlTmajJ9Q 1 1 5853 0 866.6kb 866.6kb
yellow open elastalert_status         45woY9F3S7Wz1rgR2oyT3w 1 1    0 0    247b    247b
yellow open elastalert_status_past    SZpur5B8Tze9bkvz79Jh8g 1 1    0 0    247b    247b
yellow open elastalert_status_silence k2Txf1yHToqQJorw30DmyQ 1 1    0 0    247b    247b
yellow open elastalert_status_error   prCbAU6vQgeTI17Ihxopjw 1 1    0 0    247b    247b

[jertel]

Please see #11. Start a new discussion topic and include all requested information. Specifically error message, logs, etc.