TypeError: 'NoneType' object is not iterable while issuing queries to Elastic Search about elasticsplunk HOT 6 OPEN

@lmammino,

This is because of the Elastic api client currently is on 5.x on elasticsplunk, and due to breaking changes on Elastic 6.x (mainly one doc_type per index).

I'll update the API client and adjust the elasticsplunk code in order to support both 5/6 versions and let you know here.

Thanks!

from elasticsplunk.

Yes :)
Thanks!

from elasticsplunk.

Hi @lmammino, thanks for the detailed issue!

Can you please try using the doc_type (stype=default) for the indexed document?

from elasticsplunk.

@brunotm,
thanks for your quick reply.

I just tried it now and I have a very similar result:

External search command 'ess' returned error code 1. Script output = "error_message=TypeError at "/opt/splunk/etc/apps/elasticsplunk/bin/splunklib/searchcommands/internals.py", line 519 : 'NoneType' object is not iterable "

from elasticsplunk.

Thanks for having a better look. I don't expect any commitment being this an open source project, but do you think you will have bandwidth anytime soon to work on supporting elastic 6.x?

from elasticsplunk.

@lmammino
i just had the time to look at this, and it happens that the current client is still compatible and i overlooked you ess options.

Could you please change the action to action=search with the correct stype as before (you can also omit it for this case.

The following example works fine with your example above:

|ess eaddr="http://localhost:9200" action=search query="foo:bar" fields=* include_es=true include_raw=true tsfield=ts stype=default

Remember to check if the following also works for you:

|ess eaddr="http://localhost:9200" action=indices-list

Change the localhost with your ES address.

Cheers.

from elasticsplunk.