[Information sharing] A warning appears when connecting to elasticsearch8. Alert notifications work fine.

[nsano-rururu]

I will add the log and the docker image that I confirmed to work.
This is a log that I happened to notice when upgrading elastalert-server.

elasticsearch 8.17
docker image: johnsusek/elastalert-server:20241227 (include elastalert 2.22.0)

14:12:08.852Z  INFO elastalert-server: Config:  No config.dev.json file was found in /opt/elastalert-server/config/config.dev.json.
14:12:08.854Z  INFO elastalert-server: Config:  Proceeding to look for normal config file.
14:12:08.855Z  INFO elastalert-server: Config:  A config file was found in /opt/elastalert-server/config/config.json. Using that config.
14:12:08.864Z  INFO elastalert-server: Router:  Listening for GET request on /.
14:12:08.864Z  INFO elastalert-server: Router:  Listening for GET request on /status.
14:12:08.864Z  INFO elastalert-server: Router:  Listening for GET request on /status/errors.
14:12:08.864Z  INFO elastalert-server: Router:  Listening for GET request on /rules.
14:12:08.866Z  INFO elastalert-server: Router:  Listening for GET request on /rules/:id*.
14:12:08.867Z  INFO elastalert-server: Router:  Listening for POST request on /rules/:id*.
14:12:08.867Z  INFO elastalert-server: Router:  Listening for DELETE request on /rules/:id*.
14:12:08.868Z  INFO elastalert-server: Router:  Listening for GET request on /templates.
14:12:08.868Z  INFO elastalert-server: Router:  Listening for GET request on /templates/:id*.
14:12:08.868Z  INFO elastalert-server: Router:  Listening for POST request on /templates/:id*.
14:12:08.869Z  INFO elastalert-server: Router:  Listening for DELETE request on /templates/:id*.
14:12:08.869Z  INFO elastalert-server: Router:  Listening for PUT request on /folders/:type/:path*.
14:12:08.869Z  INFO elastalert-server: Router:  Listening for DELETE request on /folders/:type/:path*.
14:12:08.869Z  INFO elastalert-server: Router:  Listening for POST request on /test.
14:12:08.870Z  INFO elastalert-server: Router:  Listening for POST request on /silence/:path*.
14:12:08.870Z  INFO elastalert-server: Router:  Listening for GET request on /config.
14:12:08.870Z  INFO elastalert-server: Router:  Listening for POST request on /config.
14:12:08.870Z  INFO elastalert-server: Router:  Listening for GET request on /metadata/elastalert.
14:12:08.870Z  INFO elastalert-server: Router:  Listening for GET request on /metadata/elastalert_status.
14:12:08.870Z  INFO elastalert-server: Router:  Listening for GET request on /metadata/silence.
14:12:08.871Z  INFO elastalert-server: Router:  Listening for GET request on /metadata/elastalert_error.
14:12:08.871Z  INFO elastalert-server: Router:  Listening for GET request on /metadata/past_elastalert.
14:12:08.871Z  INFO elastalert-server: Router:  Listening for GET request on /indices.
14:12:08.871Z  INFO elastalert-server: Router:  Listening for GET request on /mapping/:index.
14:12:08.871Z  INFO elastalert-server: Router:  Listening for POST request on /search/:index.
14:12:08.871Z  INFO elastalert-server: Router:  Listening for GET request on /config.
14:12:08.876Z  INFO elastalert-server: ProcessController:  Starting ElastAlert
14:12:08.876Z  INFO elastalert-server: ProcessController:  Creating index
14:12:10.186Z  INFO elastalert-server:
    ProcessController:  Reading Elastic 8 index mappings:
    Reading index mapping 'es_mappings/8/silence.json'
    Reading index mapping 'es_mappings/8/elastalert_status.json'
    Reading index mapping 'es_mappings/8/elastalert.json'
    Reading index mapping 'es_mappings/8/past_elastalert.json'
    Reading index mapping 'es_mappings/8/elastalert_error.json'
    Index praeco_elastalert_status already exists. Skipping index creation.
    
14:12:10.186Z  INFO elastalert-server: ProcessController:  Index create exited with code 0
14:12:10.187Z  INFO elastalert-server: ProcessController:  Starting elastalert with arguments [none]
14:12:10.191Z  INFO elastalert-server: ProcessController:  Started Elastalert (PID: 42)
14:12:10.193Z  INFO elastalert-server: Server:  Server listening on port 3030
14:12:10.194Z  INFO elastalert-server: Server:  Websocket listening on port 3333
14:12:10.195Z  INFO elastalert-server: Server:  Server started
14:12:34.670Z  INFO elastalert-server: Routes:  Successfully handled GET request for '/'.
14:13:04.786Z  INFO elastalert-server: Routes:  Successfully handled GET request for '/'.
14:13:11.509Z ERROR elastalert-server:
    ProcessController:  WARNING:py.warnings:/home/node/.local/lib/python3.12/site-packages/elasticsearch/connection/base.py:193: ElasticsearchDeprecationWarning: Deprecated field [from] used, this field is unused and will be removed entirely
      warnings.warn(message, category=ElasticsearchDeprecationWarning)
    
    
14:13:11.509Z ERROR elastalert-server:
    ProcessController:  WARNING:py.warnings:/home/node/.local/lib/python3.12/site-packages/elasticsearch/connection/base.py:193: ElasticsearchDeprecationWarning: Deprecated field [to] used, this field is unused and will be removed entirely
      warnings.warn(message, category=ElasticsearchDeprecationWarning)
    
    
14:13:34.889Z  INFO elastalert-server: Routes:  Successfully handled GET request for '/'.
14:14:05.041Z  INFO elastalert-server: Routes:  Successfully handled GET request for '/'.
14:14:35.164Z  INFO elastalert-server: Routes:  Successfully handled GET request for '/'.````

[jertel]

Do you know where this is occurring? I don't see the warning in my log.

[gregorywychowaniec-zt]

Hello,

I have been receiving this message since the update of our ELK in v8.16.0 at the startup of Elastalert.
After some investigation, it seems that this Elastic query uses the old range format with from/to, which will be removed in v9.0 according to this MR. This likely explains the message.

[jertel]

I've not yet upgraded to 8.16 so that explains why I'm not seeing it. Thanks!

[jertel]

Resolved in #1599.