I'm new to elasticsearch and I'm trying to find logs with the event id 4625 every minute but getting this error. I can't figure out where I am going wrong.
GET /_search
{
"query": {
"match": {
"event_id": "4,625"
}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1m",
"to": "now"
}
}
}
}
This is the response I'm getting:
{
"error": {
"root_cause": [
{
"type": "parsing_exception",
"reason": "Unknown key for a START_OBJECT in [filter].",
"line": 7,
"col": 13
}
],
"type": "parsing_exception",
"reason": "Unknown key for a START_OBJECT in [filter].",
"line": 7,
"col": 13
},
"status": 400
}
Actually I am trying to start a watcher for alerting. I was getting that error so I was checking each part to check in which line I was getting the error. This is where I saw the filter.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.