How to query 2 fields in the input section

alerting

#1

Hi,

I am curious about is it possible to query 2 fields at the same time? If it is possible, how?

the first field i want to match is "response: 500"
the second field is a timestamp range

I tried something like

"input" : {
"http" : {
"request" : {
"host" : "localhost",
"port" : 9200,
"path" : "'/filebeat-2016.10.20/_search?pretty'",
"body" : "{
"query" : {
"and" : [
{
"range": {
"@timestamp" : {
"from": "2016-10-20T23:58:00.000Z",
"to": "2016-10-20T23:59:00.000Z"
}
}
},
{
"match" : { "response" : "500"}
}
]
}
}"
}
}
},

but failed

thanks for any help


#2

problem solved, just type the query part in one line


(Alexander Reelsen) #3

I f you dont want to escape all that JSON, but write it as regular JSON, you can use the search input instead of the HTTP one - might be less error prone.


(system) #4