This is my rather trivial logstash config:
input {
elasticsearch {
hosts => "localhost"
query => '{"query": {"match": {"tags": "pipeline-v0.6"}}}'
# query => '{"query": {"match": {"tags": "pipeline-v0.6"}}, "fields": ["message"]}'
size => 10
}
}
output {
stdout {
codec => rubydebug
}
}
When used as-is, it works fine. When using the commented query instead, this error occurs (over and over again):
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Elasticsearch hosts=>["localhost"], query=>"{\"query\": {\"match\": {\"tags\": \"pipeline-v0.6\"}}, \"fields\": [\"message\"]}", size=>10, codec=><LogStash::Codecs::JSON charset=>"UTF-8">, index=>"logstash-*", scan=>true, scroll=>"1m", docinfo=>false, docinfo_target=>"@metadata", docinfo_fields=>["_index", "_type", "_id"], ssl=>false>
Error: undefined method `[]' for nil:NilClass {:level=>:error}
When running the query in curl, it works just fine either way.
Context (just in case you've got a completely different approach): When refining my filter{} (which I store in another file, and didn't use to test this), I don't want to juggle the original test files, but instead just use this input and another elasticsearch {} output to work through all the indexed documents.