Apache live stats using elasticsearch and logstash

Elastic Stack Elasticsearch
17

I am running ubuntu and running like suggested gave me the same error .

500 Internal Server Error and the below description. Really
appreciate your help
Thanks

curl "localhost:9200/logstash-2012.05.04/apache-access/_search?pretty=true"
-d @request.txt
{
"error" : "SearchPhaseExecutionException[Failed to execute phase [query],
total failure; shardFailures
{[evarIQDhQu-Jj8DapZc8QA][logstash-2012.05.04][2]:
SearchParseException[[logstash-2012.05.04][2]: from[-1],size[-1]: Parse
Failure [Failed to parse source [{ "query": { "range": {
"@timestamp": { "gte": "now-2d" } } }, "facets":
{ "term1": { "terms": { "field": "@fields.clientip"
} } }}]]]; nested: MapperParsingException[failed to parse date
field [now-2d], tried both date format [dateOptionalTime], and timestamp
number]; nested: IllegalArgumentException[Invalid format: "now-2d"];
}{[evarIQDhQu-Jj8DapZc8QA][logstash-2012.05.04][1]:
SearchParseException[[logstash-2012.05.04][1]: from[-1],size[-1]: Parse
Failure [Failed to parse source [{ "query": { "range": {
"@timestamp": { "gte": "now-2d" } } }, "facets":
{ "term1": { "terms": { "field": "@fields.clientip"
} } }}]]]; nested: MapperParsingException[failed to parse date
field [now-2d], tried both date format [dateOptionalTime], and timestamp
number]; nested: IllegalArgumentException[Invalid format: "now-2d"]; }]",
"status" : 500

On Friday, May 4, 2012 10:09:52 PM UTC+10, Igor Motov wrote:

Are you running it on Windows? Try saving the query into a text file
request.txt:

{
"query": {
"range": {
"@timestamp": {
"gte": "now-1d"
}
}
},
"facets": {
"term1": {
"terms": {
"field": "@fields.clientip"
}
}
}
}

and then run it like this:

curl
"localhost:9200/logstash-2012.05.03/apache-access/_search?pretty=true" -d
@request.txt

You might also need to increase -1d to -2d since your requests in this
index are now at least a day old.

On Friday, May 4, 2012 7:59:16 AM UTC-4, user16 wrote:

HI i ran it from the local console elasticsearch is running and also
using the "dev http client" app on chrome.

On Friday, May 4, 2012 8:20:02 PM UTC+10, Igor Motov wrote:

How do you run it?

On Friday, May 4, 2012 1:11:09 AM UTC-4, user16 wrote:

Hmm.. I get the below error if i try the below query

{

  • "error":query":{
    • \n"range":{
      • \n"@timestamp":{
        • \n"gte":"now-2d"\n "SearchPhaseExecutionException[Failed
          to execute phase [query], total failure; shardFailures
          {[skrcTvObR1-EEH8JTETjIQ][logstash-2012.05.04][1]:
          SearchParseException[[logstash-2012.05.04][1]: from[-1],size[-1]: Parse
          Failure [Failed to parse source [{\n "
          }\n
          }\n
          },
  • \n"facets":{
    • \n"term1":{
      • \n"terms":{
        • \n"field":"@fields.clientip"\n
          }\n
          }\n
          }\n

}