Hello,
I have using LS filter for fire query with ES and get matched record from ES.
but i have getting this error
[2019-03-27T15:10:29,993][WARN ][logstash.filters.elasticsearch] Failed to query elasticsearch for previous event {:index=>"test_index", :query=>{"query"=>{"query_string"=>{"query"=>"idUser:1 AND (currentData:>='0' OR currentData:>=0)"}}, "size"=>1, "sort"=>[{"@timestamp"=>"desc"}]}, :event=>#<LogStash::Event:0x53ff2293>, :error=>#<Faraday::ConnectionFailed>}
so i can not understood why i got Faraday::ConnectionFailed error.
My LS configuration is here:
if ([fields][log_type] == "test_index") {
elasticsearch {
hosts => ["http://192.168.0.203:9200"]
index => "test_index"
query => "unique_id:%{[unique_id]}"
fields => {
"currentData" => "PreviousData"
"@timestamp" => "lastTimeStamp"
}
}
ruby {
code => 'event.set("UsedData", ((event.get("currentData").to_i)-(event.get("PreviousData").to_i)))'
}
if [WMExpon] == "FF" {
mutate {
replace => {
"[type]" => "test_index"
"currentData" => "-1"
}
add_field => {
"Status" => 0
}
strip => ["ReadTime"]
}
} else {
mutate {
replace => {
"[type]" => "test_index"
}
add_field => {
"Status" => 0
}
strip => ["ReadTime"]
}
}
fingerprint {
source => ["ReadDate", "ReadTime", "idUser"]
target => "[@metadata][fingerprint]"
method => "MURMUR3"
concatenate_sources => true
}
}
i have read log data using Filebeat and put records into ES using LS.
can anyone help me why i getting this errors.