Does elastalert work with ElasticSearch 6 - elasticsearch

Have an elastalert docker image (https://hub.docker.com/r/ivankrizsan/elastalert/) that worked with elasticsearch 5.6, changed to a test environment with ElasticSearch 6.1 (no index) and now get
Creating Elastalert index in Elasticsearch...
Traceback (most recent call last):
File "/usr/bin/elastalert-create-index", line 11, in <module>
load_entry_point('elastalert', 'console_scripts', 'elastalert-create-index')()
File "/opt/elastalert/elastalert/create_index.py", line 153, in main
es.indices.put_mapping(index=index, doc_type='elastalert', body=es_mapping)
File "build/bdist.linux-x86_64/egg/elasticsearch/client/utils.py", line 73, in _wrapped
File "build/bdist.linux-x86_64/egg/elasticsearch/client/indices.py", line 282, in put_mapping
File "build/bdist.linux-x86_64/egg/elasticsearch/transport.py", line 312, in perform_request
File "build/bdist.linux-x86_64/egg/elasticsearch/connection/http_requests.py", line 90, in perform_request
File "build/bdist.linux-x86_64/egg/elasticsearch/connection/base.py", line 125, in _raise_error
elasticsearch.exceptions.RequestError: TransportError(400, u'mapper_parsing_exception', u'No handler for type [string] declared on field [aggregate_id]')

As of now, elastalert does not support for elasticsearch 6.0 out of the box. Here is the open issue on github: https://github.com/Yelp/elastalert/issues/1399 that tracks the issue. A walk-around is also mentioned in https://github.com/Yelp/elastalert/pull/1426.

Please upgrade to latest version of elastalert.
I am using Elasticsearch 6.2 with ElastAlert 0.1.29 and they work properly.

Related

Run docker-compose with podman as a backend on MacOS

I am trying to run docker-compose CLI with podman backend on my local machine (MacOS). Here is what I did:
Install podman using brew: brew install podman
Initialize the podman machine: podman machine init
Started the machine: podman machine start
Running podman version gives me this:
Client:
Version: 3.4.4
API Version: 3.4.4
Go Version: go1.17.6
Built: Wed Dec 8 19:41:11 2021
OS/Arch: darwin/amd64
Server:
Version: 3.4.4
API Version: 3.4.4
Go Version: go1.16.8
Built: Wed Dec 8 22:45:07 2021
OS/Arch: linux/amd64
I created a symlink for podman (ln -s podman docker), so running docker version gives me the same and I can actually run containers using docker run even though docker is not installed.
Afterwards I installed docker-compose using:
sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
docker-compose version gives me this:
docker-compose version 1.29.2, build 5becea4c
docker-py version: 5.0.0
CPython version: 3.9.0
OpenSSL version: OpenSSL 1.1.1h 22 Sep 2020
Problem is that docker-compose up test is not working as docker-compose doesn't seem to find the docker host to connect to or is somehow blocked, does somebody know how to solve this issue:
Traceback (most recent call last):
File "urllib3/connectionpool.py", line 670, in urlopen
File "urllib3/connectionpool.py", line 392, in _make_request
File "http/client.py", line 1255, in request
File "http/client.py", line 1301, in _send_request
File "http/client.py", line 1250, in endheaders
File "http/client.py", line 1010, in _send_output
File "http/client.py", line 950, in send
File "docker/transport/unixconn.py", line 43, in connect
ConnectionRefusedError: [Errno 61] Connection refused
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "requests/adapters.py", line 439, in send
File "urllib3/connectionpool.py", line 726, in urlopen
File "urllib3/util/retry.py", line 410, in increment
File "urllib3/packages/six.py", line 734, in reraise
File "urllib3/connectionpool.py", line 670, in urlopen
File "urllib3/connectionpool.py", line 392, in _make_request
File "http/client.py", line 1255, in request
File "http/client.py", line 1301, in _send_request
File "http/client.py", line 1250, in endheaders
File "http/client.py", line 1010, in _send_output
File "http/client.py", line 950, in send
File "docker/transport/unixconn.py", line 43, in connect
urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionRefusedError(61, 'Connection refused'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "docker/api/client.py", line 214, in _retrieve_server_version
File "docker/api/daemon.py", line 181, in version
File "docker/utils/decorators.py", line 46, in inner
File "docker/api/client.py", line 237, in _get
File "requests/sessions.py", line 543, in get
File "requests/sessions.py", line 530, in request
File "requests/sessions.py", line 643, in send
File "requests/adapters.py", line 498, in send
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionRefusedError(61, 'Connection refused'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "docker-compose", line 3, in <module>
File "compose/cli/main.py", line 81, in main
File "compose/cli/main.py", line 200, in perform_command
File "compose/cli/command.py", line 60, in project_from_options
File "compose/cli/command.py", line 152, in get_project
File "compose/cli/docker_client.py", line 41, in get_client
File "compose/cli/docker_client.py", line 170, in docker_client
File "docker/api/client.py", line 197, in __init__
File "docker/api/client.py", line 221, in _retrieve_server_version
docker.errors.DockerException: Error while fetching server API version: ('Connection aborted.', ConnectionRefusedError(61, 'Connection refused'))
[63757] Failed to execute script docker-compose
Did you install podman-mac-helper?
sudo /opt/homebrew/Cellar/podman/4.0.2/bin/podman-mac-helper install
docker-compose v2.3.4 works just fine with Podman v4.0.2 on a MacBook Pro M1 running macOS Monterey as long as you install podman-mac-helper (which makes /var/run/docker.sock available.)

VirtualBox anaconda installation failing

Having trouble installing anaconda on my Ubuntu VirtualBox. Have tried rebooting and have tried assigning a bigger chunk of base memory but still failing at the final few hurdles.
Unpacking payload ...
concurrent.futures.process._RemoteTraceback:
'''
Traceback (most recent call last):
File "concurrent/futures/process.py", line 368, in _queue_management_worker
File "multiprocessing/connection.py", line 251, in recv
TypeError: __init__() missing 1 required positional argument: 'msg'
'''
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "entry_point.py", line 69, in <module>
File "concurrent/futures/process.py", line 484, in _chain_from_iterable_of_lists
File "concurrent/futures/_base.py", line 611, in result_iterator
File "concurrent/futures/_base.py", line 439, in result
File "concurrent/futures/_base.py", line 388, in __get_result
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or
pending.
[1981] Failed to execute script entry_point

Using command/shell modules causes: ValueError: Key name may not begin with an underscore on multiple runs

Ansible throws an error on every task which uses the shell or command modules, but not when running for the first time on a new machine.
The process I use is to image a new raspberry pi, and then use ansible to set up the services that I need. Running ansible for the first time works fine, but if I run it again (without changing anything) it fails, saying ValueError: Key name may not begin with an underscore
Here is an example of a task that throws an error. Running /usr/local/bin/pigpiod -v on the remote machine works as expected/
- name: see if pigpiod is the correct version
command: "/usr/local/bin/pigpiod -v"
register: pigpiod_version
Here is the error:
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ValueError: Key name may not begin with an underscore
fatal: [issacs_box]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n File \"<stdin>\", line 113, in <module>\n File \"<stdin>\", line 105, in _ansiballz_main\n File \"<stdin>\", line 48, in invoke_module\n File \"/usr/lib/python3.5/imp.py\", line 234, in load_module\n return load_source(name, filename, file)\n File \"/usr/lib/python3.5/imp.py\", line 170, in load_source\n module = _exec(spec, sys.modules[name])\n File \"<frozen importlib._bootstrap>\", line 626, in _exec\n File \"<frozen importlib._bootstrap_external>\", line 673, in exec_module\n File \"<frozen importlib._bootstrap>\", line 222, in _call_with_frames_removed\n File \"/tmp/ansible_command_payload_hc3z4iej/__main__.py\", line 292, in <module>\n File \"/tmp/ansible_command_payload_hc3z4iej/__main__.py\", line 199, in main\n File \"/tmp/ansible_command_payload_hc3z4iej/ansible_command_payload.zip/ansible/module_utils/basic.py\", line 901, in __init__\n File \"/tmp/ansible_command_payload_hc3z4iej/ansible_command_payload.zip/ansible/module_utils/basic.py\", line 2243, in _log_invocation\n File \"/tmp/ansible_command_payload_hc3z4iej/ansible_command_payload.zip/ansible/module_utils/basic.py\", line 2201, in log\n File \"systemd/_journal.pyx\", line 68, in systemd._journal.send\n File \"systemd/_journal.pyx\", line 32, in systemd._journal._send\nValueError: Key name may not begin with an underscore\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}
I had the wrong PYPI package installed. Coincidentally, there is a package called systemd (version 0.16.1) which is different from the official systemd-python (version 234) package. Running pip3 uninstall systemd and then pip3 install systemd-python --user solved the problem.
Seems like a weird Ansible bug. What version are you using? Can you try to downgrade and/or upgrade a version. If that would fix this error, please notify the Ansible developers and create an issue at their repo.
Else, try to update and/or downgrade your Python version. It could be that something is wrong with this file /usr/lib/python3.5/imp.py

h2o hit_ratio_table AttributeError

I'm following a tutorial from https://github.com/h2oai/h2o-tutorials/blob/master/tutorials/gbm-randomforest/GBM_RandomForest_Example.py
I have been following the tutorial until I reached the line with hit_ratio_table. when I executed
"rf_v1.hit_ratio_table(valid=True)", I encounter the error below.
>>> rf_v1.hit_ratio_table(valid=True)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/home/h2oUser/sparkling-water-2.3.0/py/build/dist/h2o_pysparkling_2.3-2.3.0.zip/h2o/utils/backward_compatibility.py", line 74, in __getattr__
File "/home/h2oUser/sparkling-water-2.3.0/py/build/dist/h2o_pysparkling_2.3-2.3.0.zip/h2o/utils/backward_compatibility.py", line 49, in __getattribute__
AttributeError: type object 'H2ORandomForestEstimator' has no attribute 'hit_ratio_table'
I tried to search if hit_ratio_table is being deprecated or not, but I can't find any links. Does anyone know if this function has been changed?
The attribute is still there, it looks like the tutorial is missing a line of code right after the file import, which means the model is being considered as a regression problem instead of a classification problem. So if you add the following line after you import the covtype dataset:
covtype_df[54] = covtype_df[54].asfactor()
which converts the target to a factor, it should work.
If you want to play around with the hit_ratio_table() you can look at this code snippet in the H2O-3 user guide.

Elastalert creating index not working

I'm installing elastalert in my local installation of ELK. When I run the command 'elastalert-create-index' I got this error message:
Traceback (most recent call last):
File "C:\Python27\Scripts\elastalert-create-index-script.py", line 11, in <module>
load_entry_point('elastalert==0.1.8', 'console_scripts', 'elastalert-create-index')()
File "C:\Python27\Scripts\elastalert\create_index.py", line 83, in main
profile_name=args.profile)
File "C:\Python27\Scripts\elastalert\auth.py", line 24, in __call__
aws_access_key=credentials.access_key,
AttributeError: 'NoneType' object has no attribute 'access_key'
Any idea?
Had the same issue, fixed by editing config.yaml, setting host/port there and uncommenting es_username & es_password.
Our ES instance is local and not password protected. Still worked with the default username & password (ignores it I guess).
Not a fix, but a workaround.
This could occur due to a number of possible reasons.
elasticsearch might not be running
If not, start elasticsearch
The elastalert version might not be compatible with elasticsearch.
The version of elastalert and elasticsearch should be same or atleast close. Ex: If elasticsearch version is 5.0.0 then elastalert version should also be 5.0.0 or something close to it.
Ensure that the host and port specified in config.yaml are correct.
Check if access key is specified properly.

Resources