Sending alerts just works with type: any but is not taken the max_threshold

[masterplanx]

Hi Team!

I am having an issue configuring elastalert2 to send alerts to slack, I am using the official helm chart

rules:
  cpu_usage_output: |-
    ---
    name: CPU usage
    type: metric_aggregation
    index: metricbeat-*
    metric_agg_key: system.cpu.total.pct
    metric_agg_type: avg
    query_key: beat.hostname
    doc_type: _doc
    max_threshold: 0.1
    filter:
    - term:
        metricset.name: cpu
    alert:
    - "slack"
    slack:
    slack_webhook_url: "https://hooks.slack.com/services/xxxxxxxxxxxxxxxxxxxxxxxxxx"

I set "max_threshold: 0.1" just to test the alert because my avg nodes are around 0.2 0.3 percent. This is not working
not sending the alerts, if I change "type: metric_aggregation" to "type: any" it works, the alerts are sending to the proper slack
Channel, But looks like is not taken the threshold, because when I changed the value to 0.8 or 0.9, It starts to send the alert in a loop.
I used examples configuration from here: https://github.com/jertel/elastalert2/blob/master/example_rules/example_single_metric_agg.yaml
But I get the same behavior.
Any ideas if there is a solution for this? I am lost because I tried a lot of possibilities.

"I tried to running elastalert test from cli"
Thanks!

[nsano-rururu]

max_threshold is a metric_aggregation setting and is not used by any. It is a specification. There is nothing I can do about it.

Confirm that only metric_aggregation is used even in the source code usage
https://github.com/jertel/elastalert2/blob/master/elastalert/ruletypes.py#L1049

[masterplanx]

Hi @nsano-rururu ! thanks for the answer. I am using max_threshold with metric_aggregation: type, But is not taking the max_threshold, so is not sending alerts to slack, Not sure if there is an error in the configuration, I used "type: any" just to test, but is sending alerts every 1 minute, it doesn't matter the threshold (I think is because is a metric_aggregation as you say).