{"action":"created","issue":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/648","repository_url":"https://api.github.com/repos/Yelp/elastalert","labels_url":"https://api.github.com/repos/Yelp/elastalert/issues/648/labels{/name}","comments_url":"https://api.github.com/repos/Yelp/elastalert/issues/648/comments","events_url":"https://api.github.com/repos/Yelp/elastalert/issues/648/events","html_url":"https://github.com/Yelp/elastalert/issues/648","id":167045101,"number":648,"title":"Whitelists doesn't seems to work","user":{"login":"arall","id":1453137,"avatar_url":"https://avatars0.githubusercontent.com/u/1453137?v=3","gravatar_id":"","url":"https://api.github.com/users/arall","html_url":"https://github.com/arall","followers_url":"https://api.github.com/users/arall/followers","following_url":"https://api.github.com/users/arall/following{/other_user}","gists_url":"https://api.github.com/users/arall/gists{/gist_id}","starred_url":"https://api.github.com/users/arall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arall/subscriptions","organizations_url":"https://api.github.com/users/arall/orgs","repos_url":"https://api.github.com/users/arall/repos","events_url":"https://api.github.com/users/arall/events{/privacy}","received_events_url":"https://api.github.com/users/arall/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2016-07-22T13:27:40Z","updated_at":"2017-07-13T17:34:09Z","closed_at":"2016-08-05T08:07:03Z","body":"Here is my rule:\n\n``` yaml\nname: Security - Apache Access events frequency\ntype: frequency\nindex: logstash-access-apache\nnum_events: 600\ntimeframe:\n  minutes: 1\nalert:\n- hipchat\nuse_terms_query: true\ndoc_type: apache_access\nquery_key: clientip.raw\n\nfields:\n- clientip.raw\n- geoip.country_name\n\ntop_count_keys:\n- beat.hostname\n- app\n- request\n\ncompare_key: clientip.raw\nwhitelist: [\"1.2.3.4\", \"5.6.7.8\"]\n\nhipchat_auth_token: XXX\nhipchat_room_id: XXX\n```\n\nLogs with the IPs 1.2.3.4 and 5.6.7.8 are triggered as well, and as I understood, it should not work like that.\n"},"comment":{"url":"https://api.github.com/repos/Yelp/elastalert/issues/comments/315148278","html_url":"https://github.com/Yelp/elastalert/issues/648#issuecomment-315148278","issue_url":"https://api.github.com/repos/Yelp/elastalert/issues/648","id":315148278,"user":{"login":"Qmando","id":3246990,"avatar_url":"https://avatars0.githubusercontent.com/u/3246990?v=3","gravatar_id":"","url":"https://api.github.com/users/Qmando","html_url":"https://github.com/Qmando","followers_url":"https://api.github.com/users/Qmando/followers","following_url":"https://api.github.com/users/Qmando/following{/other_user}","gists_url":"https://api.github.com/users/Qmando/gists{/gist_id}","starred_url":"https://api.github.com/users/Qmando/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Qmando/subscriptions","organizations_url":"https://api.github.com/users/Qmando/orgs","repos_url":"https://api.github.com/users/Qmando/repos","events_url":"https://api.github.com/users/Qmando/events{/privacy}","received_events_url":"https://api.github.com/users/Qmando/received_events","type":"User","site_admin":false},"created_at":"2017-07-13T17:34:09Z","updated_at":"2017-07-13T17:34:09Z","body":"```\r\ntype: any\r\nfilter:\r\n - not:\r\n      terms:\r\n         srx-source-zone-name: [\"EXTERNAL\"]\r\n```\r\n\r\nis equivalent to\r\n\r\n```\r\ntype: whitelist\r\ncompare_key: srx-source-zone-name\r\nwhitelist:\r\n - EXTERNAL\r\n```"}}
{"actor":{"display_login":"Qmando"}}