Elastalert container missing

[lerou114]

Version 2.3.100
I have been running at this version for a few days with no issues.
I am having an issue with Elastalert container missing in my deployment. I have run salt-call state.highstate which has returned not errors. Any assistance would be appreciated.

elastalert log snippet:
2022-02-09 20:38:40,800 WARNING elasticsearch GET https://...:9200/%3Aso-/_search?_source_includes=%40timestamp%2C%2A&ignore_unavailable=true&scroll=30s&size=5000 [status:N/A request:141.317s]
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 445, in _make_request
six.raise_from(e, None)
File "", line 3, in raise_from
File "/usr/local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 440, in _make_request
httplib_response = conn.getresponse()
File "/usr/local/lib/python3.9/http/client.py", line 1371, in getresponse
response.begin()
File "/usr/local/lib/python3.9/http/client.py", line 319, in begin
version, status, reason = self._read_status()
File "/usr/local/lib/python3.9/http/client.py", line 280, in _read_status
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/usr/local/lib/python3.9/socket.py", line 704, in readinto
return self._sock.recv_into(b)
File "/usr/local/lib/python3.9/ssl.py", line 1241, in recv_into
return self.read(nbytes, buffer)
File "/usr/local/lib/python3.9/ssl.py", line 1099, in read
return self._sslobj.read(len, buffer)
socket.timeout: The read operation timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 755, in urlopen
retries = retries.increment(
File "/usr/local/lib/python3.9/site-packages/urllib3/util/retry.py", line 532, in increment
raise six.reraise(type(error), error, _stacktrace)
File "/usr/local/lib/python3.9/site-packages/urllib3/packages/six.py", line 770, in reraise
raise value
File "/usr/local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 699, in urlopen
httplib_response = self._make_request(
File "/usr/local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 447, in _make_request
self._raise_timeout(err=e, url=url, timeout_value=read_timeout)
File "/usr/local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 336, in _raise_timeout
raise ReadTimeoutError(
urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='...', port=9200): Read timed out. (read timeout=55)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/elasticsearch/connection/http_requests.py", line 77, in perform_request
response = self.session.send(prepared_request, **send_kwargs)
File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 529, in send
raise ReadTimeout(e, request=request)
requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='...', port=9200): Read timed out. (read timeout=55)
2022-02-09 20:38:48,443 ERROR elastalert Error running query: ConnectionTimeout caused by - ReadTimeout(HTTPSConnectionPool(host='...', port=9200): Read timed out. (read timeout=55))
2022-02-09 20:38:35,117 WARNING elasticsearch GET https://...:9200/%3Aso-/_search?_source_includes=%40timestamp%2C%2A&ignore_unavailable=true&scroll=30s&size=5000 [status:N/A request:123.217s]

elastalert-20220209.zip

[IzacFrank]

Hello,

I had the same issue and I moved all my elastalert rules to another folder and executed "sudo so-elastalert-restart" command. Then it started to run then I moved all back.

You have one warning "WARNING elasticsearch GET https://...:9200/%3Aso-/_search? "
I think you should check this line on your last added rule.

I hope it helps.

[lerou114]

Thank you that fixed it for me.