elastalert_error index mapping

[vvvlad]

Good day everyone.
Looking for some understanding of elastalert_error index mapping.
The index keeps the failed rule name under data.name.
The mapping is:

"data" : {
  "type" : "object",
  "enabled" : false
}

which AFAIK means that there is no way to search by failed index name.
What is the reason for this mapping and is it possible to change it in the elastalert configuration?

Thanks

[nsano-rururu]

Did you read the source code?
https://github.com/jertel/elastalert2/blob/master/elastalert/create_index.py

[vvvlad]

@nsano-rururu
I don't understand what you mean.

[nsano-rururu]

I don't want to get involved

[vvvlad]

I don't want to get involved

Ok, I'm not sure what you mean by getting involved.

Thanks for pointing me to the source, that helped me to find the definition file.

[nsano-rururu]

I haven't seen the source code, and I understand that I'm not technically familiar with this point.

[nsano-rururu]

how I change it if I just want to pip install the package without changing internal files.

See the following documentation for pip installation.
https://elastalert2.readthedocs.io/en/latest/running_elastalert.html#as-a-python-package