Sql in elasticsearch/kibana

Elastic Stack Elasticsearch
1

We have a logstash file with documents like:

message:
2018-11-22 07:23:44,374 :: HWM :: INFO :: ########## Service Status: {'weight': True, 'main_cam': True, 'bp': True, 'scanner': True, 'oto_nose': True, 'thermo': True, 'ox': True, 'oto_ear': True, 'oto_mouth': True}
@timestamp:
November 22nd 2018, 07:23:44.374
loglevel:
INFO
_id:
I_dxvmcBKIwFz2orGn-N
_type:
_doc
_index:
kiosk-hwm-index
_score:
-
We need to do things like select all docs where main_cam="False" . Basically queries of sub-queries of sub-queries. Users at our organization are familiar with SQL and would like to use it, as opposed to learning a new language. What is the best study/learning document you can suggest?

2

You really need to split the message contents into their own fields using grok first.

3

Will do. THANK YOU!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.