A quick and dirty bash script for querying Elasticsearch
./es_query.sh -l <labels> -u <uri> -n <number> -f <field>
-l (labels):
Comma delimited list of : formatted labels to query against-u (uri):
Elasticsearch URI to query (with auth credentials, if enabled)-n (number):
Number of results to return from query-f (field):
The field in logged event to return (log, message, or MESSAGE)
A comma delimited list of key:value formatted labels to query Elasticsearch for. These labels are typically applied by a log gathering daemon (Fluentbit, Fluentd, Filebeat, etc). They must be defined as indexed fields in your Elasticsearch index to be able to query against them.
The endpoint for the Elasticsearch instance to query. If basic auth is enabled, the endpoint must include the user and password.
The number of results to return. By default, Elasticsearch will only return the top ten matches for a query.
The field that includes the log message desired. The default logstash index will place the content of the message under the log field. The systemd input plugin for Fluentbit places the content of the message under the MESSAGE field. Most other messages, including the OpenStack oslo fluentd formatter, are placed under the message field.
./es_query.sh -l kubernetes.labels.application.keyword:elasticsearch, \
kubernetes.labels.component.keyword:data \
-u http://user:password@elasticsearch:9200 \
-n 100
-f log
./es_query.sh -l SYSTEMD_UNIT:docker.service \
-u http://user:password@elasticsearch:9200 \
-n 100
-f MESSAGE