elastalert Error posible bug

[JhonShell]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

512

Storage for /

100

Storage for /nsm

1tb

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi Community,
I am currently having this error message after some month running the security onion without issue, any sugesntion please.
log:
File "/usr/local/lib/python3.11/site-packages/elasticsearch/connection/base.py", line 315, in _raise_error
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
elasticsearch.exceptions.TransportError: TransportError(429, 'circuit_breaking_exception', '[parent] Data too large, data for [indices:data/write/bulk[s]] would be [5228856992/4.8gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5228850224/4.8gb], new bytes reserved: [6768/6.6kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=2018702/1.9mb, request=0/0b, fielddata=716912/700.1kb]')
2024-10-10 17:38:33,027 ERROR elastalert Error running query: TransportError(429, 'search_phase_execution_exception', '[parent] Data too large, data for [indices:data/read/search[phase/query]] would be [5350486376/4.9gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5350485040/4.9gb], new bytes reserved: [1336/1.3kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=487168/475.7kb, request=0/0b, fielddata=716912/700.1kb]')
2024-10-10 17:38:33,032 WARNING elasticsearch POST https://miah-pv-manager:9200/elastalert_error/_doc [status:429 request:0.004s]
2024-10-10 17:38:33,033 ERROR elastalert Error writing alert info to Elasticsearch: TransportError(429, 'circuit_breaking_exception', '[parent] Data too large, data for [indices:data/write/bulk[s]] would be [5262568492/4.9gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5262562368/4.9gb], new bytes reserved: [6124/5.9kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=491956/480.4kb, request=0/0b, fielddata=716912/700.1kb]')
self._raise_error(response.status_code, raw_data)
File "/usr/local/lib/python3.11/site-packages/elasticsearch/connection/base.py", line 315, in _raise_error
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
elasticsearch.exceptions.TransportError: TransportError(429, 'search_phase_execution_exception', '[parent] Data too large, data for [indices:data/read/search[phase/query]] would be [5350486376/4.9gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5350485040/4.9gb], new bytes reserved: [1336/1.3kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=487168/475.7kb, request=0/0b, fielddata=716912/700.1kb]')
self._raise_error(response.status_code, raw_data)
File "/usr/local/lib/python3.11/site-packages/elasticsearch/connection/base.py", line 315, in _raise_error
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
elasticsearch.exceptions.TransportError: TransportError(429, 'circuit_breaking_exception', '[parent] Data too large, data for [indices:data/write/bulk[s]] would be [5262568492/4.9gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5262562368/4.9gb], new bytes reserved: [6124/5.9kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=491956/480.4kb, request=0/0b, fielddata=716912/700.1kb]')
2024-10-10 17:38:33,060 ERROR elastalert Error writing alert info to Elasticsearch: TransportError(429, 'circuit_breaking_exception', '[parent] Data too large, data for [indices:data/write/bulk[s]] would be [5380003840/5gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5380002880/5gb], new bytes reserved: [960/960b], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=486792/475.3kb, request=0/0b, fielddata=716912/700.1kb]')
self._raise_error(response.status_code, raw_data)
File "/usr/local/lib/python3.11/site-packages/elasticsearch/connection/base.py", line 315, in _raise_error
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
elasticsearch.exceptions.TransportError: TransportError(429, 'circuit_breaking_exception', '[parent] Data too large, data for [indices:data/write/bulk[s]] would be [5380003840/5gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5380002880/5gb], new bytes reserved: [960/960b], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=486792/475.3kb, request=0/0b, fielddata=716912/700.1kb]')
2024-10-10 17:38:37,709 ERROR elastalert Error running query: TransportError(429, 'search_phase_execution_exception', '[parent] Data too large, data for [indices:data/read/search[phase/query]] would be [5226079210/4.8gb], which is larger than the limit of [5156057907/4.8gb], real usage: [5225958088/4.8gb], new bytes reserved: [121122/118.2kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=3716928/3.5mb, request=0/0b, fielddata=716912/700.1kb]')
2024-10-10 17:38:38,252 ERROR elastalert Error running query: RequestError(400, 'verification_exception', 'Found 1 problem\nline 1:163: Unknown column [winlog.event_data.LocalName]')

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[JhonShell]

I fix it with so-elasticsearch-query _cluster/settings -d '{"persistent": {"indices.breaker.total.limit": "6gb" }}' -X PUT , however I am still no able to acknowledge the alert open .