_formatted values not available in alerts

[dennis-trapp]

I can't seem to get the metric_agg_value_formatted or metric_<metric_agg_key>_avg_formatted in alerts

Version 2.23.0

name: Queue Threshold
is_enabled: true
type: metric_aggregation

index: queues-*

metric_agg_type: avg
metric_agg_key: queueSize
metric_format_string: "{:.2f}"
metric_agg_script:
  script: "doc['queues.bytes'].value / 1000 / 1000 / 10"
max_threshold: 4.0

buffer_time:
  minutes: 10

use_local_time: false

query_key:
  - "aaa"
  - "bbb"
  - "ccc"
realert:
  minutes: 10

filter:
  - bool:
      must:
        - term:
            "data_stream.dataset": "queues"
        - exists:
            field: "queues.bytes"
      must_not:
        - term:
            "zzz": "zzz"

alert_text: "**{0}** - ALERT: queue is {1}"
alert_text_args:
  - name
  - metric_agg_value_formatted
  - metric_queueSize_avg_formatted
  - metric_queueSize_avg

alert:
  - debug

Result:

INFO:elastalert:**Queue Threshold** - ALERT: queue is <MISSING VALUE>

Threshold violation, avg:queueSize 28.14 (min: None max : 4.0)

@timestamp: 2025-02-26T21:47:34.207677Z
aaa: <snip>
bbb: <snip>
ccc: <snip>
aaa,bbb,ccc: <snip>,<snip>,<snip>
kibana_discover_url: <snip>
metric_queueSize_avg: 28.142857142857142
num_hits: 650704
num_matches: 19

The value is properly formatted in the Threshold violation message, but I can't seem to get to it with the alert. I tried metric_agg_value_formatted, metric_queueSize_avg_formatted, throwing them in include and include_fields, and include_rule_params_in_matches. I also tried using metric_agg_key: queues.bytes without the metric_agg_script.

What am I doing wrong?

[jertel]

The problem is the compound query_key. There are a couple of known issues with using a query_key list rather than a simple query_key string value.

[dennis-trapp]

Thank you for the quick reply! I can't use a simple query_key in my situation, so I'll need to find a different approach.