# Using http\_poller to search Elasticsearch

**URL:** <https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612>\
**Category:** Logstash\
**Created:** [September 1, 2016, 11:38pm UTC](https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612 "2016-09-01T23:38:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Post date:** [September 1, 2016, 11:38pm UTC](https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612/1 "2016-09-01T23:38:26Z")

</div>

I want to use [http\_poller](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http_poller.html) to do the equivalent of this:

```auto
curl -XGET 'http://esnode:9200/_all/_search?pretty' -d '{ 
    "query": { 
        "term": {
            "type" : "syslog"
         }
    }
}'

```

Basically, I want the full power of the Elasticsearch search api.

Using the URI search feature does work. But I think it would be hard to get very complicated in your searches.

Any suggestions? Am I missing something obvious in the docs?

Thanks!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 1, 2016, 11:44pm UTC](https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612/2 "2016-09-01T23:44:03Z")

</div>

Suggestions for what, exactly?

---

<div class="post-metadata">

**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Post date:** [September 2, 2016, 12:22am UTC](https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612/3 "2016-09-02T00:22:04Z")

</div>

On how to send the -d part of the curl call via http\_poller.

```auto
input {

http_poller {
  interval => 30
  urls => {
    test1 => {
      url => "http://esnode:9200/_all/_search?q=type:syslog"
      method => get
    }
  }
  codec => "json"
}

}

output {
stdout { codec => "rubydebug" }
}

```

Works just fine. But how would I replace the `q=type:syslog` with what's in the `-d '...'` part of my example curl call?

I don't want to encode the query in the url. The request body search syntax is a lot easier to understand when you have lots of search parameters.

---

<div class="post-metadata">

**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Post date:** [September 2, 2016, 9:39pm UTC](https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612/4 "2016-09-02T21:39:35Z")

</div>

For example, I'm really not sure how to change this search into something that works in the url.

```auto
curl -XGET 'http://node:9200/_all/_search?pretty' -d '{ 
"query":{
  "range":{
    "date":{
      "gt":"now-1m/m"
      },
    "mem.actual_used_p": {
      "gte":0.25
      }
    }
  }
}'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/using-http-poller-to-search-elasticsearch/59612/5 "2017-07-06T04:40:08Z")

</div>

Closed on July 6, 2017, 4:40am UTC