Elastalert RAM and CPU utilization is high

Hi @Qmando @danielpops @snuids @JeffAshton @alvarolmedo ,

We are running elastalert with 20 YAML rules querying elastic search indexes. Observed elastalert python process consuming 100% of memory and CPU spikes are also very high. seems like elastalert is freezing memory with all the fetched records for each query running.

Is there any way other than using use_count_query: True

we have been using below YAML

type: frequency num_events: 10 timeframe: minutes: 5

query_key:

• beat.name

filter:

• range: system.process.cpu.total.pct: from: 0.9 to: 10.0