# Elasticsearch Queries
**URL:** https://discuss.elastic.co/t/elasticsearch-queries/88942
**Category:** Elasticsearch
**Created:** [June 11, 2017, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942 "2017-06-11T07:52:56Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Mannu\_Choudhary](https://discuss.elastic.co/u/Mannu_Choudhary)
#### Post date: [June 11, 2017, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/1 "2017-06-11T07:52:56Z")
I'm trying some scenarios using ELK. As I'm new to ELK could you guys help me out to make some queries for my below need.
Senarios:
1:- Find the no of occurrence of particular string. like ResourceManager
2:- Response time (find the time between two specific string). like between first ResourceManager to last last ResourceManager.
3:- Pattern matching (few specific line one after another).
4:- Threshold break (Like CPU \> 80) - Theshold string capture.
Example log file - Logstash to Elasticsearch
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool general - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool sysquery - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool sysdata - Memory(KB)
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool wosdata - Memory(KB)
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool tm - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool refresh - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool recovery - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool dbd - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool jvm - Queries
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool blobdata - File Handles
2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool metadata - Memory(KB) - Threshold breakup \> 80%
2017-03-14 12:23:43.477 unknown:0x7f3a7e [Init] Dumping out open file descriptors
2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 0[[STDIN]] -\> /dev/null
2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 1[[STDOUT]] -\> /data/disks\_a/db/dbLog
2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 2[[STDERR]] -\> /data/disks\_a/db/dbLog
2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 3[Unknown] -\> /proc/160845/fd
2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 4[Unknown] -\> /opt/vertica/log/adminTools.errors
2017-03-14 12:23:43.478 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 5[Unknown] -\> /dev/null
2017-03-14 12:23:43.478 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 6[Unknown] -\> /data/disks\_a/db/node0001\_catalog/startup.log
2017-03-14 12:23:43.478 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 7[Unknown] -\> /data/disks\_a/db/node0001\_catalog/ErrorReport.txt
Thank you.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 11, 2017, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/2 "2017-06-11T08:23:08Z")
What have you tried so far?
---
### Author:  [@Mannu\_Choudhary](https://discuss.elastic.co/u/Mannu_Choudhary)
#### Post date: [June 12, 2017, 7:32pm UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/3 "2017-06-12T19:32:23Z")
Hi Warkolm,
Here is what I've done so far - loaded file from logstash to elasticsearch
logstash-ver.conf file:-
`input {
file {
path =\> ["/home/release/ver2.log"]
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "varlog-%{+YYYY.MM.dd}"
document\_type =\> "system\_logs"
}
stdout { codec =\> rubydebug }
}
`
STEP 2:- /opt/logstash/bin/logstash -f logstash-ver.conf
Simple query - just to check out the occurrences of word 'catalog'
curl -XGET '[http://localhost:9200/verticalog-2017.06.12/log/\_search?pretty](http://localhost:9200/verticalog-2017.06.12/log/_search?pretty)' -d '{
"query": {
"function\_score": {
"query": {
"filtered": {
"query": {
"bool": {
"must": {
"query\_string": {
"query": "Catalog\*",
"fields": [
"@version",
"host",
"message",
"path",
"tags",
"type"
]
}
},
"should": []
}
},
"filter": {
"bool": {
"must": []
}
}
}
},
"functions": []
}
},
"size": "50"
}'
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 13, 2017, 8:28am UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/4 "2017-06-13T08:28:07Z")
That grok pattern does not match the log though, you probably need a custom pattern.
---
### Author:  [@Mannu\_Choudhary](https://discuss.elastic.co/u/Mannu_Choudhary)
#### Post date: [June 13, 2017, 11:33am UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/5 "2017-06-13T11:33:58Z")
> [@Mannu\_Choudhary](#):
>
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool general - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool sysquery - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool sysdata - Memory(KB)
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool wosdata - Memory(KB)
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool tm - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool refresh - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool recovery - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool dbd - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool jvm - Queries
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool blobdata - File Handles
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [ResourceManager] pool metadata - Memory(KB) - Threshold breakup \> 80%
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e [Init] Dumping out open file descriptors
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 0[[STDIN]] -\> /dev/null
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 1[[STDOUT]] -\> /data/disks\_a/db/dbLog
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 2[[STDERR]] -\> /data/disks\_a/db/dbLog
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 3[Unknown] -\> /proc/160845/fd
> 2017-03-14 12:23:43.477 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 4[Unknown] -\> /opt/vertica/log/adminTools.errors
> 2017-03-14 12:23:43.478 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 5[Unknown] -\> /dev/null
> 2017-03-14 12:23:43.478 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 6[Unknown] -\> /data/disks\_a/db/node0001\_catalog/startup.log
> 2017-03-14 12:23:43.478 unknown:0x7f3a7e @node0001: 00000/4273: Open FD 7[Unknown] -\> /data/disks\_a/db/node0001\_catalog/ErrorReport.txt
Could you please suggest a query to give me the below results -
ID Message ID message Log Start Time Log End Time Count
1 1 ResourceManager 2017-03-14 12:23:43 2017-03-14 12:23:43 11
Thanks.
---
### Author:  [@Mannu\_Choudhary](https://discuss.elastic.co/u/Mannu_Choudhary)
#### Post date: [June 13, 2017, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/6 "2017-06-13T12:22:24Z")
```
curl -XGET 'http://localhost:9200/varlog-2017.06.12/log/_count?q=message:ResourceManager'
```
I'm getting the count via this query but not able to pull out the other info, like log start time and log end time within the same elastic search query.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2017, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-queries/88942/7 "2017-07-11T12:22:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.