NAME

es-search.pl - Provides a CLI for quick searches of data in ElasticSearch daily indexes

VERSION

version 1.4

SYNOPSIS

es-search.pl [search string]

Options:

--help              print help
--manual            print full manual
--verbose           Send additional messages to STDERR
--show              Comma separated list of fields to display, default is ALL, switches to tab output
--exists            Field which must be present in the document
--missing           Field which must not be present in the document
--index             Search only this index by name!
--days              Days back, default 5
--base              Index basename, default 'logstash' (try: access, proxy)
--size              Result size, default is 20
--asc               Sort by ascending timestamp
--desc              Sort by descending timestamp (Default)
--fields            Display the field list for this index!
--host              Cluster node to connect to, defaults to localhost
--port              HTTP port to connect to, defaults to 9200
--no-refresh        Don't refresh server list, useful for use over SSH Tunnels

DESCRIPTION

This tool takes a search string parameter to search the cluster. It is in the format of the Lucene query string

Examples might include:

# Search for past 10 days vhost admin.example.com and client IP 1.2.3.4
es-search.pl --days=10 --size=100 dst:"admin.example.com" AND src_ip:"1.2.3.4"

# Search for all apache logs past 5 days with status 500
es-search.pl program:"apache" AND crit:500

# Search for all apache logs past 5 days with status 500 show only file and out_bytes
es-search.pl program:"apache" AND crit:500 --show file,out_bytes

# Search for ip subnet client IP 1.2.3.0 to 1.2.3.255 or 1.2.0.0 to 1.2.255.255
es-search.pl --size=100 dst:"admin.example.com" AND src_ip:"1.2.3.*"
es-search.pl --size=100 dst:"admin.example.com" AND src_ip:"1.2.*"

Helpful in building queries is the --fields options which lists the fields:

es-search.pl --fields

NAME

es-search.pl - Search a logging cluster for information

OPTIONS

help

Print this message and exit

manual

Print detailed help with examples

show

Comma separated list of fields to display in the dump of the data

--show src_ip,crit,file,out_bytes

exists

Filter results to those containing a valid, not null field

--exists referer

Only show records with a referer field in the document.

missing

Filter results to those not containing a valid, not null field

--missing referer

Only show records without a referer field in the document.

fields

Display a list of searchable fields

index

Search only this index for data, may also be a comma separated list

days

The number of days back to search, the default is 5

base

Index base name, will be expanded using the days back parameter. The default is 'logstash' which will expand to 'logstash-YYYY.MM.DD'

size

The number of results to show, default is 20.

host

Cluster node to connect to, defaults to localhost.

port

Transport port, default is 9200

AUTHOR

Brad Lhotsky <brad@divisionbyzero.net>

COPYRIGHT AND LICENSE

This software is Copyright (c) 2012 by Brad Lhotsky.

This is free software, licensed under:

The (three-clause) BSD License