Helm Chart: "query malformed, no start_object after query name"

[RefusesNames]

I understand that this error message means I using a malformed query, however I fail to see how this is different from the documentation/examples. Am I just not seeing the problem or is this an actual bug (considering there are no open issues yet, I guess the former).

This is my values.yaml:

elastalert:
  elasticsearch:
    host: elasticsearch-master.infra.svc.cluster.local
  extraConfigOptions:
    slack_webhook_url: "..."
    slack_channel_override: "#elastalert"
  rules:
    test: |-
      name: "Rule Name" 
      type: any
      index: logstash-*
      filter:
      - term:
        kubernetes.container_name: "some-name"
      alert:
      - "slack"

This was heavily inspired by the values.yaml in the chart.
The exact error message is

ERROR:root:Error running query: RequestError(400, 'x_content_parse_exception', '[term] query malformed, no start_object after query name')

So I guess the problem is with the term, but it looks exactly like in the values.yaml of the chart. What am I doing wrong?

[jertel]

Your spacing/indent is incorrect on the line under - term:

Should look like this, from the values.yaml you linked: