Comments (6)
Hey there! ESQuery doesn't support NOT
atm, because afaik it's equivalent to a:b AND -a:c
. I can add support for NOT
if people start asking for it.
In the case of your particular query, I think you can do type:authlog _exists_:failure -ssh_interface:public
(since AND
is the default).
from 411.
Thanks for the tip.
The search now tests fine with your query, but I'm still getting an angry red error Error: Catch all: Expected ":" or [a-zA-Z0-9._] but " " found.
at the top of the search details page, and the main search page claims it's failing. I also got an email reporting it's recovered, so I'm not sure what to think.
[edit] this seems to have cleared up once I enabled the search.
I do wonder if you're going to support Lucene queries whether we can't have full support for basic query structure (including NOT). As we're collecting and indexing all the logs, there's a lot of junk in the ES indexes that I'd like to exclude. Using the same syntax as we have in Kibana makes it easy for users to create alerts based on the dashboards they're used to using.
Loving 411 so far though.
Cheers.
from 411.
Ah, that error message shows the status of the last execution of that Search (which was a syntax error).
Wrt. to NOT
, fair enough. I've opened #20 to keep track of these issues and I'll fix them as they come up. Lemme know if you see any other inconsistencies and thanks for the feedback. :]
from 411.
Awesome - thanks!
from 411.
Fixed in aeb144b.
from 411.
Hi again,
The fix seems to work (it's generating emails and showing OK on the search list), however hitting 'Test' on the search detail page generates the same error.
Never mind. I did a bad thing. ;)
from 411.
Related Issues (20)
- "dot" in Elasticsearch Index fields HOT 1
- Daily Rollup Email config HOT 1
- Is 411's URL configurable? HOT 3
- Node ping options HOT 3
- Elasticsearch 'include' is deprecated HOT 2
- /api/data not found HOT 1
- Issue in Alert Generation HOT 2
- Are these abandoned composer dependencies an issue? HOT 1
- Source link generation problems HOT 1
- Lists broken: "contains unrecognized parameter: [ttl]" HOT 5
- Autoclose job disregards autoclose_threshold HOT 1
- HTML in Description HOT 2
- Modify e-mail templates
- Missing docker files
- elasticsearch 6 Load more is not working
- Frontend slowdown, freezes and errors
- Infinite loading bar HOT 1
- elasticsearch 7 support HOT 5
- Demo Site is down HOT 3
- SQLSTATE[HY000]: General error: 8 attempt to write a readonly database HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from 411.