From ee69696e3312e816b796c2030496caec406a2a80 Mon Sep 17 00:00:00 2001
From: StevenXUzw <stevenxzw@outlook.com>
Date: Mon, 11 Nov 2019 23:39:58 +0800
Subject: [PATCH] SpikeRule remove self.first_event.pop(qk)

time frame sliding window
---
 elastalert/ruletypes.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/elastalert/ruletypes.py b/elastalert/ruletypes.py
index 2f1d2f82c..743e41541 100644
--- a/elastalert/ruletypes.py
+++ b/elastalert/ruletypes.py
@@ -436,7 +436,7 @@ def add_data(self, data):
     def clear_windows(self, qk, event):
         # Reset the state and prevent alerts until windows filled again
         self.ref_windows[qk].clear()
-        self.first_event.pop(qk)
+#         self.first_event.pop(qk)
         self.skip_checks[qk] = lookup_es_key(event, self.ts_field) + self.rules['timeframe'] * 2
 
     def handle_event(self, event, count, qk='all'):