ESS queries not working about elasticsplunk HOT 8 CLOSED

Here is one of the searches: | ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" Here is the search job properties: canSummarize None createTime 2018-01-22T10:09:09.000-08:00 cursorTime 2038-01-18T19:14:07.000-08:00 custom { [-]<http://localhost:8000/en-US/manager/search/job_inspector?sid=1516644548.22#> dispatch.earliest_time: 0 dispatch.latest_time: dispatch.sample_ratio: 1 display.general.type: statistics display.page.search.mode: smart display.page.search.tab: statistics search: | ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" } defaultSaveTTL 604800 defaultTTL 600 delegate None diskUsage 114688 dispatchState DONE doneProgress 1 dropCount None eai:acl { [-]<http://localhost:8000/en-US/manager/search/job_inspector?sid=1516644548.22#> app: search can_write: true modifiable: true owner: admin perms: { [+]<http://localhost:8000/en-US/manager/search/job_inspector?sid=1516644548.22#> } sharing: global ttl: 600 } earliestTime 1969-12-31T16:00:00.000-08:00 eventAvailableCount None eventCount None eventFieldCount None eventIsStreaming true eventIsTruncated true eventSearch None eventSorting desc isBatchModeSearch None isDone true isEventsPreviewEnabled None isFailed None isFinalized None isPaused None isPreviewEnabled true isRealTimeSearch None isRemoteTimeline None isSaved None isSavedSearch None isTimeCursored None isZombie None keywords None label None modifiedTime 2018-01-22T10:09:23.032-08:00 normalizedSearch None numPreviews None optimizedSearch | ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" pid 4858 priority 5 provenance UI:Search remoteSearch None reportSearch ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" request { [-]<http://localhost:8000/en-US/manager/search/job_inspector?sid=1516644548.22#> adhoc_search_level: smart auto_cancel: 30 check_risky_command: false custom.dispatch.earliest_time: 0 custom.dispatch.latest_time: custom.dispatch.sample_ratio: 1 custom.display.general.type: statistics custom.display.page.search.mode: smart custom.display.page.search.tab: statistics custom.search: | ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" earliest_time: 0 indexedRealtime: latest_time: preview: 1 provenance: UI:Search rf: * sample_ratio: 1 search: | ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" status_buckets: 300 ui_dispatch_app: search } resultCount None resultIsStreaming None resultPreviewCount None runDuration 1.915207337 runtime { [-]<http://localhost:8000/en-US/manager/search/job_inspector?sid=1516644548.22#> auto_cancel: 30 auto_pause: 0 } sampleRatio 1 sampleSeed 0 scanCount None search | ess eaddr="http://localhost:9200/cif.observables-2018.01" query="otype:fqdn" searchCanBeEventType None searchProviders [ ] searchTotalBucketsCount None searchTotalEliminatedBucketsCount None sid 1516644548.22 statusBuckets None ttl 600 Additional info search.log <http://localhost:8000/en-US/api/search/jobs/1516644548.22/search.log?outputMode=raw>

OK. And how do I increase the log verbosity? From: Bruno Moura [mailto:[email protected]] Sent: Tuesday, January 23, 2018 12:33 PM To: brunotm/elasticsplunk <[email protected]> Cc: Craig Merchant (Americas) <[email protected]>; Author <[email protected]> Subject: Re: [brunotm/elasticsplunk] ESS queries not working (#10) This is the job inspector output, in the same window you’ll find a link for the search.log. Please attach it here. Thanks — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#10 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AfkbhHLK91fJXcXZVZDwL21osgJn7G3hks5tNkILgaJpZM4RlmOs>. itevomcid

There you go. Thanks! C

We probably can handle it by updating the elasticsearch python library. I’ll check and update. Thanks for investigating this!

-- Bruno Moura +351 932 518 676