Hi all,
I am using elasticsearch input in my logstash config file. logstash input part is as following:
input {
elasticsearch {
hosts => ["http://10.0.0.1:9200/"]
index => "my-log*"
query => '{
"from" : 0,
"size" : 1,
"query": {
"bool" : {
"must" : {
"match": { "status1": 0 }
},
"filter" : {
"range" : { "mytimestamp" : { "gte": "now-1d/d", "lte": "now-1d/d"}}
}
}
}
}'
}
It is expected that the query returns just one event because of size value, but all events will return. how can i handle the number of events which will be returned in query? I just want to elasticsearch return me the one event. Any advise will be so appreciated
Regards