ES 5, Error running query: TransportError(400

Hi, im runing ES 5 and just installed elastalert branch Support es5 #820 Im getting the following error on some of my rules, see below for error and rule.

INFO:elastalert:Ran name ms sql job error MAW from 2017-01-06 15:53 CET to 2017-01-06 16:08 CET: 0 query hits, 0 matches, 0 alerts sent WARNING:elasticsearch:GET http://localhost:9200/name-*/_search?_source_include=%40timestamp%2C%2A&ignore_unavailable=true&scroll=30s&size=10000 [status:400 request:0.004s] ERROR:root:Error running query: TransportError(400, {u'line': 1, u'root_cause': [{u'reason': u'no [query] registered for [query]', u'type': u'parsing_exception', u'line': 1, u'col': 208}], u'type': u'parsing_exception', u'reason': u'no [query] registered for [query]', u'col': 208})

name: name ms sql job error MAW
es_host: localhost
es_port: 9200
index: name-*
any: failed
type: any

filter:
- query:
    query_string:
      query: "task: *Job*"

Thanks in advance.

[Qmando]

You are definitely using support_es5 branch? This looks like a bug that was specifically fixed by https://github.com/Yelp/elastalert/pull/820/commits/bb09323ad893b22d17e0d7cb2aa50c52db18f80d.

Can you use runpython -c "import elastalert.elastalert;print elastalert.elastalert.ElastAlerter.is_five" just to verify for me that you have that branch? It should output <unbound method ElastAlerter.is_five>.

You can try changing the filter to

filter:
 - query_string:
      query: "task: *Job*"

[TroelsL]

That resolved it, thank you very much.

I would close this issue, but I just realized I hijacked another one.