Warning search scroll with Elastic 8.19.2/8.19.3

[gregorywychowaniec-zt]

Since we upgraded our Elastic stack to versions 8.19.2 and then 8.19.3, we've been encountering the following warning: WARNING:elasticsearch:DELETE https://node:9200/_search/scroll [status:404 request:0.059s].

Has anyone else experienced this issue, or it's specific to our implementation and configuration?

[jertel]

I doubt it's related to your recent Elastic upgrade. This problem has been reported for years:

#1042
#1302
#1347

It could be Elastic cleaning up scrolls automatically, or having multiple ElastAlert2 instance running, etc. I haven't dug into it, so these are just theories.

Are you experiencing other problems that you suspect is related to the warning?

[gregorywychowaniec-zt]

We didn't have these warnings before the updates, which is why we thought it might be related to a change made with the latest Elastic upgrades. In previous versions, we encountered these warnings when the indexes did not exist or the Elastalert user did not have the correct permissions.

[jertel]

You could look through the 8.19.2/3 release notes to see if anything has changed with that particular API request and permission. Perhaps it is related to the upgrade and it's resembling the same symptom as those older discussions.

[gregorywychowaniec-zt]

I have already checked all the changes in these upgrades and found nothing related. I also tried adding the superuser role directly, but that didn't change anything. That's why I preferred to ask the question in case other people had encountered this problem before investigating further.

[gooseleggs]

I have this issue as well. Not sure if it is causing problems. I am having some issues with rules not firing a the moment. I am not sure if it is because I upgraded praeco, elastic or both.