Class: LogStash::Inputs::Elasticsearch

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/elasticsearch.rb

Overview

Read from elasticsearch.

This is useful for replay testing logs, reindexing, etc.

Example:

input {
  # Read all documents from elasticsearch matching the given query
  elasticsearch {
    host => "localhost"
    query => "ERROR"
  }
}

  • TODO(sissel): configurable scroll timeout

  • TODO(sissel): Option to keep the index, type, and doc id so we can do reindexing?

Constant Summary

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes inherited from Base

#params, #threadable

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#initialize, #tag

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Inputs::Base

Instance Method Details

#register ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/logstash/inputs/elasticsearch.rb', line 52

def register
  require "ftw"
  @agent = FTW::Agent.new
  params = {
    "q" => @query,
    "scroll" => @scroll,
    "size" => "#{@size}",
  }

  params['search_type'] = "scan" if @scan

  @url = "http://#{@host}:#{@port}/#{@index}/_search?#{encode(params)}"
end

#run(output_queue) ⇒ Object 



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
 
# File 'lib/logstash/inputs/elasticsearch.rb', line 74

def run(output_queue)

  # Execute the search request
  response = @agent.get!(@url)
  json = ""
  response.read_body { |c| json << c }
  result = JSON.parse(json)
  scroll_id = result["_scroll_id"]

  # When using the search_type=scan we don't get an initial result set.
  # So we do it here.
  if @scan

    scroll_params = {
      "scroll_id" => scroll_id,
      "scroll" => @scroll
    }

    scroll_url = "http://#{@host}:#{@port}/_search/scroll?#{encode(scroll_params)}"
    response = @agent.get!(scroll_url)
    json = ""
    response.read_body { |c| json << c }
    result = JSON.parse(json)

  end

  while true
    break if result.nil?
    hits = result["hits"]["hits"]
    break if hits.empty?

    hits.each do |hit|
      event = hit["_source"]

      # Hack to make codecs work
      @codec.decode(event.to_json) do |event|
        decorate(event)
        output_queue << event
      end
    end

    # Get the scroll id from the previous result set and use it for getting the next data set
    scroll_id = result["_scroll_id"]

    # Fetch the next result set
    scroll_params = {
      "scroll_id" => scroll_id,
      "scroll" => @scroll
    }
    scroll_url = "http://#{@host}:#{@port}/_search/scroll?#{encode(scroll_params)}"

    response = @agent.get!(scroll_url)
    json = ""
    response.read_body { |c| json << c }
    result = JSON.parse(json)

    if result["error"]
      @logger.warn(result["error"], :request => scroll_url)
      # TODO(sissel): raise an error instead of breaking
      break
    end

  end
rescue LogStash::ShutdownSignal
  # Do nothing, let us quit.
end