Issues triggering an alert

[juaneloxx]

Hello, im new to elastalert, i have a fresh install and just added 1 alert for testing
I'm still not sure if the issue is my rule or is something else.
When I test the rule in debug mode with elastalert --config /opt/elastalert2/config.yaml --rule alerta_conexion_rdp_ad.yml
I get this result. https://pastebin.com/9y6a153d

But when i try with elastalert --config /opt/elastalert2/config.yaml --rule alerta_conexion_rdp_ad.yml
which is supposed to trigger the alert and actually send the alert i get this. https://pastebin.com/NFftB5m7

as you can see my conf file is on /opt/elastalert2/config.yaml
This is my config file.

rules_folder: /opt/elastalert2/rules/
run_every:
  minutes: 1
buffer_time:
  minutes: 15
es_host: localhost
es_port: 9200
writeback_index: elastalert_status
writeback_alias: elastalert_alerts
alert_time_limit:
 days: 2
es_username: *********
es_password: ********* 

And just in case, this is the rule im testing.

name: Acceso AD RDP
description: test juanelo
type: any
index: winlogbeat*
run_every:
 minutes: 15
timeframe:
 hours: 24
filter:
  - query:
      query_string:
        query: 'winlog.channel:"Security" AND winlog.event_data.AuthenticationPackageName:"Negotiate" AND winlog.event_id:"4624" AND winlog.event_data.LogonType:"10" AND winlog.event_data.TargetUserName:Admin*'

include: ["user.name", "source.ip", "event.action", "event.outcome"]

alert:
 - telegram:
       telegram_bot_token:*************
       telegram_room_id:*************

I want to receive the alerts on a telegram group chat.

sorry about my english, not my native language.

[jertel]

It's difficult to read your post. Use triple back ticks to denote a multi line block of code instead of using single back ticks on each line.

It looks like you have a colon after the telegram alerter list item which probably shouldn't be there.

[juaneloxx]

I'm still new to this but i assume winlogbeat* includes all the indices shown below

[nsano-rururu]

Are you running elastalert-create-index?
https://elastalert2.readthedocs.io/en/latest/running_elastalert.html#setting-up-elasticsearch

[nsano-rururu]

Try changing from index: winlogbeat*' to index: winlogbeat-*.
If that doesn't work, delete the index starting with elastalert on the kibana screen. Run elastalert-create-index again. The reason for asking for the latter work is that my guess is that the index of elastalert is currently inaccessible from elastalert2, so I think that deleting the index and recreating it will solve the problem.

[nsano-rururu]

That's all I can answer. It is up to you to decide whether to try it or solve it yourself.

[juaneloxx]

That actually worked thx a lot :)