1

I get below error get:

Traceback (most recent call last):
  File "/usr/local/bin/elastalert-test-rule", line 9, in <module>
    load_entry_point('elastalert==0.0.88', 'console_scripts', 'elastalert-test-rule')()
  File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.88-py2.7.egg/elastalert/test_rule.py", line 287, in main
    test_instance.run_rule_test()
  File "/usr/local/lib/python2.7/dist-packages/elastalert-0.0.88-py2.7.egg/elastalert/test_rule.py", line 269, in run_rule_test
    rule_yaml = yaml.load(fh)
  File "build/bdist.linux-x86_64/egg/yaml/__init__.py", line 71, in load
  File "build/bdist.linux-x86_64/egg/yaml/constructor.py", line 37, in get_single_data
  File "build/bdist.linux-x86_64/egg/yaml/composer.py", line 39, in get_single_node
  File "build/bdist.linux-x86_64/egg/yaml/parser.py", line 98, in check_event
  File "build/bdist.linux-x86_64/egg/yaml/parser.py", line 174, in parse_document_start
yaml.parser.ParserError: expected '<document start>', but found '<block mapping start>'
  in "example_rules/example_frequency.yaml", line 20, column 1

Content in example_rules/example_frequency.yaml is:

  es_host: localhost
  es_port: 9200
  name: Ravi
 type: frequency
 index: logstash-*
 num_events: 50
 timeframe:
  hours: 4
filter:

- term:
    country: "India1"
alert:
- "email"
email:
- "ravi.pandey@paytm.com"
Paul Rooney
  • 20,879
  • 9
  • 40
  • 61
Ravi Ranjan Pandey
  • 11
  • 1
  • Your question is very similar to this one: http://stackoverflow.com/questions/24983938/what-does-yaml-parser-parsererror-expected-document-start-but-found-blo and you would get what you want simply by indenting correctly your file. – zezollo Jun 21 '16 at 13:06

0 Answers0