title: NO alert received on elastalert-test-rule or while executing the rule
body: <p>I have done setup on windows 10. Getting below output when executing elastalert-test-rule for my rule.</p>
  
  <pre><code>elastalert-test-rule example_rules\example_frequency.yaml --config config.yaml
  Would have written the following documents to writeback index (default is elastalert_status):
  
  elastalert_status - {'rule_name': 'Example frequency rule', 'endtime': datetime.datetime(2020, 4, 19, 18, 49, 10, 397745, tzinfo=tzutc()), 'starttime': datetime.datetime(2019, 4, 17, 3, 13, 10, 397745, tzinfo=tzutc()), 'matches': 4, 'hits': 4, '@timestamp': datetime.datetime(2020, 4, 19, 18, 55, 56, 314841, tzinfo=tzutc()), 'time_taken': 405.48910188674927}
  </code></pre>
  
  <p>However, no alert is triggered.
  Please find below contents of config.yaml and example_frequency.yaml</p>
  
  <p>config.yaml</p>
  
  <pre><code># This is the folder that contains the rule yaml files
  # Any .yaml file will be loaded as a rule
  rules_folder: example_rules
  
  # How often ElastAlert will query Elasticsearch
  # The unit can be anything from weeks to seconds
  run_every:
    seconds: 5
  
  # ElastAlert will buffer results from the most recent
  # period of time, in case some log sources are not in real time
  buffer_time:
    minutes: 15
  
  # The Elasticsearch hostname for metadata writeback
  # Note that every rule can have its own Elasticsearch host
  es_host: 127.0.0.1
  
  # The Elasticsearch port
  es_port: 9200
  
  # The AWS region to use. Set this when using AWS-managed elasticsearch
  #aws_region: us-east-1
  
  # The AWS profile to use. Use this if you are using an aws-cli profile.
  # See http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
  # for details
  #profile: test
  
  # Optional URL prefix for Elasticsearch
  #es_url_prefix: elasticsearch
  
  # Connect with TLS to Elasticsearch
  #use_ssl: True
  
  # Verify TLS certificates
  #verify_certs: True
  
  # GET request with body is the default option for Elasticsearch.
  # If it fails for some reason, you can pass 'GET', 'POST' or 'source'.
  # See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport
  # for details
  #es_send_get_body_as: GET
  
  # Option basic-auth username and password for Elasticsearch
  #es_username: someusername
  #es_password: somepassword
  
  # Use SSL authentication with client certificates client_cert must be
  # a pem file containing both cert and key for client
  #verify_certs: True
  #ca_certs: /path/to/cacert.pem
  #client_cert: /path/to/client_cert.pem
  #client_key: /path/to/client_key.key
  
  # The index on es_host which is used for metadata storage
  # This can be a unmapped index, but it is recommended that you run
  # elastalert-create-index to set a mapping
  writeback_index: elastalert_status
  writeback_alias: elastalert_alerts
  
  # If an alert fails for some reason, ElastAlert will retry
  # sending the alert until this time period has elapsed
  alert_time_limit:
    days: 2
  
  # Custom logging configuration
  # If you want to setup your own logging configuration to log into
  # files as well or to Logstash and/or modify log levels, use
  # the configuration below and adjust to your needs.
  # Note: if you run ElastAlert with --verbose/--debug, the log level of
  # the "elastalert" logger is changed to INFO, if not already INFO/DEBUG.
  #logging:
  #  version: 1
  #  incremental: false
  #  disable_existing_loggers: false
  #  formatters:
  #    logline:
  #      format: '%(asctime)s %(levelname)+8s %(name)+20s %(message)s'
  #
  #    handlers:
  #      console:
  #        class: logging.StreamHandler
  #        formatter: logline
  #        level: DEBUG
  #        stream: ext://sys.stderr
  #
  #      file:
  #        class : logging.FileHandler
  #        formatter: logline
  #        level: DEBUG
  #        filename: elastalert.log
  #
  #    loggers:
  #      elastalert:
  #        level: WARN
  #        handlers: []
  #        propagate: true
  #
  #      elasticsearch:
  #        level: WARN
  #        handlers: []
  #        propagate: true
  #
  #      elasticsearch.trace:
  #        level: WARN
  #        handlers: []
  #        propagate: true
  #
  #      '':  # root logger
  #        level: WARN
  #          handlers:
  #            - console
  #            - file
  #        propagate: false
  </code></pre>
  
  <p>example_frequency.yaml</p>
  
  <pre><code># Alert when the rate of events exceeds a threshold
  
  # (Optional)
  # Elasticsearch host
  # es_host: elasticsearch.example.com
  
  # (Optional)
  # Elasticsearch port
  # es_port: 14900
  
  # (OptionaL) Connect with SSL to Elasticsearch
  #use_ssl: True
  
  # (Optional) basic-auth username and password for Elasticsearch
  #es_username: someusername
  #es_password: somepassword
  
  # (Required)
  # Rule name, must be unique
  name: Example frequency rule
  
  # (Required)
  # Type of alert.
  # the frequency rule type alerts when num_events events occur with timeframe time
  type: frequency
  
  # (Required)
  # Index to search, wildcard supported
  index: com-*
  
  # (Required, frequency specific)
  # Alert when this many documents matching the query occur within a timeframe
  num_events: 1
  
  # (Required, frequency specific)
  # num_events must occur within this amount of time to trigger an alert
  timeframe:
    days: 365
  
  # (Required)
  # A list of Elasticsearch filters used for find events
  # These filters are joined with AND and nested in a filtered query
  # For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
  filter:
  - term:
      "log_json.response.statusCode": "404"
  
  # (Required)
  # The alert is use when a match is found
  alert:
  - "email"
  
  # (required, email specific)
  # a list of email addresses to send alerts to
  email:
  - "username@mydomain.com"
  
  realert:
    minutes: 0
  </code></pre>
  
  <p>What is it that i am missing to receive alerts? Neither do i see any error on console.</p>