X-pack 6.3 sql query

Elastic Stack Elasticsearch
1

curl -X POST "http://localhost:9200/_xpack/sql?format=json" -H 'Content-Type: application/json' -d'
{
"query": "SELECT * FROM logstash-2018.06.28"
}
'
{"error":{"root_cause":[{"type":"parsing_exception","reason":"line 1:23: mismatched input '-' expecting {, ',', 'FULL', 'GROUP', 'HAVING', 'INNER', 'JOIN', 'LEFT', 'LIMIT', 'NATURAL', 'ORDER', 'RIGHT', 'WHERE'}"}],"type":"parsing_exception","reason":"line 1:23: mismatched input '-' expecting {, ',', 'FULL', 'GROUP', 'HAVING', 'INNER', 'JOIN', 'LEFT', 'LIMIT', 'NATURAL', 'ORDER', 'RIGHT', 'WHERE'}","caused_by":{"type":"input_mismatch_exception","reason":null}},"status":400}

You can not use escape( \ ).
why ?

2

Hi

Since the index name contains reserved SQL characters (-), you need to escape the index name. Try

curl -X POST "http://localhost:9200/_xpack/sql?format=json" -H 'Content-Type: application/json' -d'
{
"query": "SELECT * FROM \"logstash-2018.06.28\""
}
'
1 Like
3

Hi, Thank you for answer.

curl -X POST "http://localhost:9200/_xpack/sql?format=json" -H 'Content-Type: application/json' -d'
{
"query": "SELECT * FROM "logstash-2018.06.28""
}
'

{
"error": {
"root_cause": [
{
"type": "sql_illegal_argument_exception",
"reason": "Arrays (returned by [tags]) are not supported"
}
],
"type": "sql_illegal_argument_exception",
"reason": "Arrays (returned by [tags]) are not supported"
},
"status": 500
}

why ?

4

Please use :

"query": "SELECT * FROM \"logstash-2018.06.28\""

and not

"query": "SELECT * FROM "logstash-2018.06.28""

mind the \ escaping the " in your POST body.

5

Sorry I wrote wrong.
You can not use escape.

curl -X POST "http://localhost:9200/_xpack/sql?format=json" -H 'Content-Type: application/json' -d'
{
"query": "SELECT * FROM "logstash-2018.06.28""
}
'

response error
{
"error": {
"root_cause": [
{
"type": "sql_illegal_argument_exception",
"reason": "Arrays (returned by [tags]) are not supported"
}
],
"type": "sql_illegal_argument_exception",
"reason": "Arrays (returned by [tags]) are not supported"
},
"status": 500
}

6

Thank, Resolved.
The index of today's date should not be.

7

Also, regarding the error about arrays - Elasticsearch SQL doesn't support them at the moment.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.