jerrac
(David Reagan)
September 1, 2016, 11:38pm
1
I want to use http_poller to do the equivalent of this:
curl -XGET 'http://esnode:9200/_all/_search?pretty' -d '{
"query": {
"term": {
"type" : "syslog"
}
}
}'
Basically, I want the full power of the Elasticsearch search api.
Using the URI search feature does work. But I think it would be hard to get very complicated in your searches.
Any suggestions? Am I missing something obvious in the docs?
Thanks!
warkolm
(Mark Walkom)
September 1, 2016, 11:44pm
2
Suggestions for what, exactly?
jerrac
(David Reagan)
September 2, 2016, 12:22am
3
On how to send the -d part of the curl call via http_poller.
input {
http_poller {
interval => 30
urls => {
test1 => {
url => "http://esnode:9200/_all/_search?q=type:syslog"
method => get
}
}
codec => "json"
}
}
output {
stdout { codec => "rubydebug" }
}
Works just fine. But how would I replace the q=type:syslog
with what's in the -d '...'
part of my example curl call?
I don't want to encode the query in the url. The request body search syntax is a lot easier to understand when you have lots of search parameters.
jerrac
(David Reagan)
September 2, 2016, 9:39pm
4
For example, I'm really not sure how to change this search into something that works in the url.
curl -XGET 'http://node:9200/_all/_search?pretty' -d '{
"query":{
"range":{
"date":{
"gt":"now-1m/m"
},
"mem.actual_used_p": {
"gte":0.25
}
}
}
}'