# About Elastalert errors
**URL:** https://discuss.elastic.co/t/about-elastalert-errors/329138
**Category:** Elasticsearch
**Created:** [April 3, 2023, 12:26am UTC](https://discuss.elastic.co/t/about-elastalert-errors/329138 "2023-04-03T00:26:37Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@YUUTA.INOUE-JPN](https://discuss.elastic.co/u/YUUTA.INOUE-JPN)
#### Post date: [April 3, 2023, 12:26am UTC](https://discuss.elastic.co/t/about-elastalert-errors/329138/1 "2023-04-03T00:26:37Z")
We would like to use elasrticsearch and kibana to achieve the ability to email administrators about unusual events.
We're using elastalert2 for this purpose but the filter is in error.
We have spent a lot of time on this problem, but have not been able to solve.
So we are consulting with those who are on the road ahead. Please help us.
My elastalert commands and results are as follows,
elastalert-test-rule --config elastalert2/config.yaml examples/rules/example\_frequency.yaml --alert
##########################
##########################
Error running your filter:
TypeError("Elasticsearch.search() got multiple values for argument 'body'")
1 rules loaded
INFO:apscheduler.scheduler:Adding job tentatively -- it will be properly scheduled when the scheduler starts
INFO:elastalert:Queried rule Example frequency rule from 2023-03-29 23:21 UTC to 2023-03-29 23:36UTC: 0 / 0 hits
INFO:elastalert:Queried rule Example frequency rule from 2023-03-29 23:36 UTC to 2023-03-29 23:51UTC: 0 / 0 hits
INFO:elastalert:Queried rule Example frequency rule from 2023-03-29 23:51 UTC to 2023-03-30 00:06UTC: 0 / 0 hits
INFO:elastalert:Queried rule Example frequency rule from 2023-03-30 00:06 UTC to 2023-03-30 00:21UTC: 0 / 0 hits
INFO:elastalert:Queried rule Example frequency rule from 2023-03-30 00:21 UTC to 2023-03-30 00:22UTC: 0 / 0 hits
Would have written the following documents to writeback index (default is elastalert\_status):
elastalert\_status - {'rule\_name': 'Example frequency rule', 'endtime': datetime.datetime(2023, 3,30, 0, 22, 6, 480746, tzinfo=tzutc()), 'starttime': datetime.datetime(2023, 3, 29, 23, 21, 30, 480746,
tzinfo=tzutc()), 'matches': 0, 'hits': 0, '@timestamp': datetime.datetime(2023, 3, 30, 0,22, 6, 548239, tzinfo=tzutc()), 'time\_taken': 0.03283810615539551}
##########################
My elastalert rule file is as follows.
name: Example frequency rule
type: frequency
index: winlogbeat-7.6.2-\*
num\_events: 1
timeframe:
hours: 1
filter:
- term:
hostname: ".xxx.xxx.co.jp"
alert:
- "email"
email:
- "xxx.xxx@xxxxxxxxxx.co.jp"
smtp\_host: "xxxxxxmail.jp"
smtp\_port: 25
smtp\_ssl: false
from\_addr: "xxxxxxxxx@xxxx.xxxxx.co.jp"
alert\_text\_type: alert\_text\_only
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 3, 2023, 5:57am UTC](https://discuss.elastic.co/t/about-elastalert-errors/329138/2 "2023-04-03T05:57:31Z")
I'm not sure we can help as this is a non supported plugin/tool. You should better ask the authors or switch to the built in alerting system.
Note that some alert connectors require a commercial license or are available when running your clusters on [cloud.elastic.co](http://cloud.elastic.co).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2023, 5:57am UTC](https://discuss.elastic.co/t/about-elastalert-errors/329138/3 "2023-05-01T05:57:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.