Sql in elasticsearch/kibana

We have a logstash file with documents like:

message:
2018-11-22 07:23:44,374 :: HWM :: INFO :: ########## Service Status: {'weight': True, 'main_cam': True, 'bp': True, 'scanner': True, 'oto_nose': True, 'thermo': True, 'ox': True, 'oto_ear': True, 'oto_mouth': True}
@timestamp:
November 22nd 2018, 07:23:44.374
loglevel:
INFO
_id:
I_dxvmcBKIwFz2orGn-N
_type:
_doc
_index:
kiosk-hwm-index
_score:
-
We need to do things like select all docs where main_cam="False" . Basically queries of sub-queries of sub-queries. Users at our organization are familiar with SQL and would like to use it, as opposed to learning a new language. What is the best study/learning document you can suggest?

You really need to split the message contents into their own fields using grok first.

Will do. THANK YOU!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.