Elasticsearch 5.x requires that all sensors templates have a nested alert field defined. Without this field, an error is thrown during all searches resulting in no alerts being found. This error is found in the REST service's logs:

QueryParsingException[[nested] failed to find nested object under path [alert]];

As a result, Elasticsearch 5.x requires changes to support HCP queries. See the following sections for these changes: