When i want to launch elastalert

Hello,

It’s my first post here, for my work i must install elastalert with elasticsearch.

WHen i load my rule its works, but when i want to lauch elastalert i’ve this error:

elastalert --config ../config.yaml --rule test.yaml Traceback (most recent call last): File "/usr/local/bin/elastalert", line 9, in <module> load_entry_point('elastalert==0.0.75', 'console_scripts', 'elastalert')() File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.75-py2.7.egg/elastalert/elastalert.py", line 1332, in main client = ElastAlerter(args) File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.75-py2.7.egg/elastalert/elastalert.py", line 90, in __init__ self.conf = load_rules(self.args) File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.75-py2.7.egg/elastalert/config.py", line 362, in load_rules raise EAException('Invalid time format used: %s' % (e)) elastalert.util.EAException: Invalid time format used: type object argument after ** must be a mapping, not NoneType

If you have an idea to help me, thanks a lot !

Have a nice day !

[Qmando]

timeframe must be of the format

timeframe:
  hours: 4

or

timeframe:
  days: 1

or similar. If you don’t include the spaces before days/minutes/hours/etc, it will not be parsed correctly.

[Qmando]

You get Invalid time format used: type object argument after ** must be a mapping, not NoneType from that config? That file looks correct as it’s posted here.

It’s possible that one of the other time options is messed up in the global config.yaml? Something like buffer_time or alert_time_limit?