Querying Logstash Data in Elasticsearch Using Curl and JQ


Today I came across the need to query logstash logs directly from elasticsearch. Here is a quick example of how to do so using curl and jq.

logstash-server:~$ cat search.sh
curl -XGET 'localhost:9200/_search?pretty&size=10000' -d '
{
    "query": {
        "query_string" : {
            "query" : "facility:19,local3 AND @timestamp:[2019-08-04T03:00 TO 2019-08-04T03:15]"
        }
    },
    "sort": ["@timestamp"]
} '

logstash-server:~$ bash search.sh | jq '.hits.hits[]._source | {timestamp,host,level,message}' | head -20

Join the Conversation