Query elasticsearch from browser/webservice

[Martijn]

Hello,

I've recently upgraded my Elasticsearch environment from 2.4 to 6.2. The old ES 2.4 environment was sometimes used as a datasource by ETL processes. The ETL process involved a simple API call, which looks like this:

http://localhost:9200/filebeat-*/_search/?source=

This request also worked from by pasting it in the browser, and would return the relevant data as Lucene.

It seems that in version 6.2 the api has changed and these calls are no longer working. I've tried a simple "match all" query from the browser, but it gives me the following error:

call in browser:

http://localhost:9200/filebeat-*/_search/?source={"query":{"match_all":{}}}

response:

{"error":{"root_cause":[{"type":"illegal_state_exception","reason":"source and source_content_type parameters are required"}],"type":"illegal_state_exception","reason":"source and source_content_type parameters are required"},"status":500}

I've also tried it following the new documentation:

http://localhost:9200/filebeat-*/_search/?q={"query":{"match_all":{}}}

{"error":{"root_cause":[{"type":"query_shard_exception","reason":"Failed to parse query [{"query":{"match_all"

Has anyone managed to get the query working (with lucene in the api call)?

[DennisM (Dennis Matheson)]

You don't use lucene as part of the url; just pretty basic syntax like:

http://localhost:9200/ _search?q=field:value

If you want to use lucene you need to do a POST and include your query as the body of the request, as in:

{
"query": {
   "multi_match": {
   		"query": "Error",
   		"fields": ["theType"]
	}
}
}

[Martijn]

Hi Dennis,

Thank you for the reply. I will look into sending a POST insetad of a GET.

I did find out how to nest the lucene query in the URL. All I had to do was add the source_content_type variable, but the URL does not work with an Elasticsearch instance with basic authentication .

For those interested, the URL would look like this:

http://localhost:9200/filebeat-*/_search/?source_content_type=application/json&source={"query":{"match_all":{}}}