ElastAlert: config.yaml : aggregation option giving error - elasticsearch

Question

I have configured aggregation option in config.yaml to send summary of alerts after every 1 hour. But it is throwing following error when I try to run it.
File "elastalert.py", line 863, in run_rule
self.add_aggregated_alert(match, rule)
File "elastalert.py", line 1614, in add_aggregated_alert
alert_time = ts_now() + rule['aggregation']
TypeError: unsupported operand type(s) for +: 'datetime.datetime' and 'dict'
ERROR:root:Uncaught exception running rule Test Alert : unsupported operand type(s) for +: 'datetime.datetime' and 'dict'
INFO:elastalert:Rule Test Alert disabled
The config parameters are:
rules_folder: test_rules
run_every:
minutes: 15
buffer_time:
minutes: 30
es_host: 100.38.46.3
es_port: 9200
aggregation:
hours: 1
writeback_index: elastalert_status
alert_time_limit:
days: 2
Test Alert rule configuration:
name: Test Alert
type: metric_aggregation
index: logstash-*
buffer_time:
minutes: 30
metric_agg_key: count
metric_agg_type: sum
query_key: "name.keyword"
doc_type: counter
max_threshold: 1
min_threshold: 0
filter:
- query:
query_string:
query: "name.keyword: *timedout_count"
alert:
- "email"
email:
- "admin#abc.com"
I have followed the ElastAlert docs but not able to figure out what is causing this issue.
Thanks

Answer 1

From the error:
TypeError: unsupported operand type(s) for +: 'datetime.datetime' and 'dict'
And from your config.yaml
metric_agg_type: sum
It's trying (and faililng) to perform a sum aggregation on datetime and dict values that do not support summation. You'll need to choose an aggregation like count or unique count, probably, and adjust the logic of your alerts accordingly.