Error searching in ES about elasticsplunk HOT 5 CLOSED

@jpferrero could you try this same search quoting the index name and specifying the field holding the timestamp in your Elasticsearch index?

Eg: |ess eaddr="http://localhost:9200" index="test-index-*" query="test" tsfield="@timestamp"

from elasticsplunk.

Hi!

Same error:

|ess eaddr="http://localhost:9200" index="test-index-*" query="test" tsfield="@timestamp"

11-29-2017 11:22:31.743 +0100 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/elasticsplunk/bin/elasticsplunk.py GETINFO eaddr="http://localhost:9200" index="test-index-*" query="test" tsfield="@timestamp"': 2017-11-29 11:22:31,743, Level=DEBUG, Pid=31842, Logger=splunklib, File=search_command.py, Line=572, ElasticSplunk.process started under protocol_version=1

from elasticsplunk.

Hi! The problem was the version of python-elasticsearch included in the github. I've just updated to last version and works fine!

from elasticsplunk.

Thanks @jpferrero! I will update the bundled lib.
Which version of elasticsearch are you using?

from elasticsplunk.

ES 6.0, and last commit from https://github.com/elastic/elasticsearch-py

from elasticsplunk.