How to get only deltas in elasticsearch input

Elastic Stack Logstash
1

I would like to know how I do something like jdbc-input, that the query is always the most recent, but this using elaticsearch_input.
if it is not possible, please help me to build a query that returns everything from the last 6 months for example, follow my input

input {
      elasticsearch {
        hosts => "localhost"
        index => "XXXXXXX*"
        query => '{ "query": { "query_string": { "query": "*" } } }'
        size => 500
        scroll => "5m"
     
      }
}
2

You should use a range query for this.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.