email alert content parameters show '< VALUE > MISSING'?

Hi, guy: I met a problem, when I used the email alert, adjust the alarm template. But the email content parameters show '< VALUE > MISSING' is this why? Example: my configuration:

name: elk-flatline-test
type: flatline
es_host: x.x.x.x
es_port: 9200
index: logstash-test_log-*
threshold: 3
timeframe: 
    minutes: 1
filter:
- query:
    query_string:
        query: "status:ERROR"
use_count_query: true
doc_type: logstash-test_log
alert:
- "email"
email:
- "[e-mail]"
alert_subject: "Alert {0} at {1}"
alert_subject_args:
- status
- date
include: ['alert_text']
alert_text: 
    this is {0} at {1}
alert_text_args:
- date
- status

Email alarm content:

title:
Alert <MISSING VALUE> at <MISSING VALUE>

body:
this is <MISSING VALUE> at <MISSING VALUE>

An abnormally low number of events occurred around 2016-09-03 12:49 CST.
Between 2016-09-03 12:48 CST and 2016-09-03 12:49 CST, there were less than 3 events.

@timestamp: 2016-09-03T04:49:16.077075Z
count: 0
key: all

[Qmando]

Ah! Elastalert does the grouping. This one is not very intuitive but that value can be accessed with “key” and not whatever query_key is set to.

https://github.com/Yelp/elastalert/blob/master/elastalert/ruletypes.py#L476

Several people have run into this exact issue several times recently, so I’ll add some code to use the actual field name.

[cfbao]

Just to confirm, when using flatline rule with query_key, I should put the literal word “key” in alert_text_args? like this:

query_key: Instance
alert_text: |
  Instance {0} flatlined
alert_text_args:
  - key

and it’s still not possible to use the actual query key name (“Instance” in the example above)?