json - Need to extract the timestamp from a logstash elasticsearch cluster -

-

i'm trying determine freshness of recent record in logstash cluster, i'm having bit of trouble digesting elasticsearch dsl.

right doing extract timestamp: curl -sx 'http://localhost:9200/logstash-2015.06.02/' -d'{"query": {"match_all": {} } }' | json_pp | grep timestamp

which gets me; "@timestamp" : "2015-06-02t00:00:28.371+00:00",

i'd use elasticsearch query directly no grep hackiness.

the raw json (snipped length) looks this: 

{    "took" : 115,    "timed_out" : false,    "hits" : {       "hits" : [          {             "_index" : "logstash-2015.06.02",             "_source" : {                "type" : "syslog",                "@timestamp" : "2015-06-02t00:00:28.371+00:00",                "tags" : [                   "sys",                   "inf"                ],                "message" : "    2015/06/02 00:00:28 [info] serf: eventmemberjoin: generichost.example.com 10.1.1.10",                "file" : "/var/log/consul.log",                "@version" : 1,                "host" : "generichost.example.com"             },             "_id" : "au4xcf51cxori9nl1hro",             "_score" : 1,             "_type" : "syslog"          },       ],       "total" : 8605141,       "max_score" : 1    },    "_shards" : {       "total" : 50,       "successful" : 50,       "failed" : 0    } }

any appreciated. know query simple, don't know is.

you don't need use dsl this. can cram url query string, this:

curl -s xget 'localhost:9200/logstash-2015.06.02/_search?_source=@timestamp&size=1&sort=@timestamp:desc&format=yaml'

so:

  • _source=@timestamp means we're interested in getting @timestamp value
  • size=1 means need 1 result
  • sort=@timestamp:desc means want sort on @timestamp descending (i.e. latest first)
  • format=yaml result in yaml format bit more concise json in case

the output this:

- _index: "logstash-2015.06.02"   _type: "syslog"   _id: "au4xcf51cxori9nl1hro"   _score: 1.0   _source:     @timestamp: "2015-06-02t00:00:28.371+00:00"

you don't need json_pp anymore, can still grep @timestamp data need.

note in 1.6.0, there way filter out metadata (i.e. _index, _type, _id, _score) , _source search result using filter_path parameter in url.


Comments

Post a Comment

Popular posts from this blog

python - TypeError: start must be a integer -

-
i trying draw 5 turtles, getting typeerror on line 25. here code: import turtle wn = turtle.screen() redrose = turtle.turtle() color = input("what background color be?") fillcolor_f = input("what color of rose be?") redrose.hideturtle() redrose.speed(30) redrose.penup() redrose.left(180) redrose.forward(175) redrose.right(90) redrose.forward(30) redrose.right(90) redrose.pendown() def drawrose(red): redrose.color("pink") redrose.fillcolor(fillcolor_f) redrose.fill(true) in range(red): redrose.forward(i) redrose.right(49) in range(5): drawrose(redrose) redrose.penup() redrose.forward(350) redrose.right(144) redrose.pendown() redrose.fill(false) drawrose(50) wn.bgcolor(color) i trying draw 5 roses, produces errors. doing in interactivepython.org. you recursively calling drawrose wrong parameter. on line 23 ( for in range(red): ) expect red integer...
Read more

c# - DevExpress RepositoryItemComboBox BackColor property ignored -

-
i have following code almost works properly; private void cbstatus_drawitem(object sender, listboxdrawitemeventargs e) { string item = e.item string; if (item != null) { switch (item) { case "1": e.appearance.forecolor = color.green; e.appearance.backcolor = color.green; break; case "2": e.appearance.forecolor = color.orange; e.appearance.backcolor = color.orange; break; case "3": e.appearance.forecolor = color.red; e.appearance.backcolor = color.red; break; } } } when dropdown shown, items forecolor correct, backcolor remains whatever backcolor of theme is; i.e. if i've got set dark theme, backcolor dark, cells in gridview, rather being green/orange/red. i've tried setting e.appearance.options.usebackcolor trying set e....
Read more

django - Creating multiple model instances in DRF3 -

-
1) create multiple model instances 1 api call, asked here: how create multiple model instances django rest framework? tried solution named in link, no success. i trying upload multiple files in 1 api call. result: files uploaded (only once overwrote perform_create) 1 instance created (if send 2 files, latter created instance). my code: class fileuploadserializer(serializers.modelserializer): def __init__(self, *args, **kwargs): many = kwargs.pop('many', true) super(fileuploadserializer, self).__init__(many=many, *args, **kwargs) class meta: model = fileupload read_only_fields = ('created', 'datafile', 'owner') class fileuploadviewset(viewsets.modelviewset): queryset = fileupload.objects.all() serializer_class = fileuploadserializer parser_classes = (multipartparser, formparser, ) def perform_create(self, serializer): file_list = self.request.data.getlist('file') ...
Read more