Skip to main content
Version: 1.0.0

elasticadhoc

The command elasticadhoc queries Elasticsearch with a DSL / Lucene query provided in the search command itself. The command is helpful while testing a DSL query and for quick checks. However, due to the JSON nature of DSL queries, the command usually gets large and is hard to read. Therefore, if you need to repeat any DSL queries, the usage of elasticquery is strongly advised.

More information regarding the DSL syntax is available in the Elasticsearch documentation. The lucene query syntax is described in the Apache Lucene documentation.

Arguments

argumentrequiredformatdescription
instanceyesstringelastic instance used by the query
modenostring"ts" or "lucene" defaults to "ts"
queryyesstringescaped DSL JSON query
timestamp_fieldyesstringfield in Elasticsearch results containing the events timestamp
timestamp_usednobooleandefines if the time given in the Splunk Search is used for the query
timestamp_formatnostringpython strpftime format string, if not provided the command does its best to recognize the timestamp format
replacementsnostringkv-pairs used to replace tokens in query

Examples

Query index kibana_sample_data_logs with time constraints set using the searches timerange

| elasticadhoc 
instance="elastic_cluster"
timestamp_used="true"
timestamp_format=""
timestamp_field="timestamp"
replacements=""
query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"kibana_sample_data_logs\"}}}}}"

Query index kibana_sample_data_logs without time constraints

| elasticadhoc 
instance="elastic_cluster"
timestamp_used="false"
timestamp_format=""
timestamp_field="timestamp"
replacements=""
query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"kibana_sample_data_logs\"}}}}}"

Query index kibana_sample_data_logs using replacement and within time selected in timerangepicker of Splunk search

| elasticadhoc 
instance="elastic_cluster"
timestamp_used="true"
timestamp_format=""
timestamp_field="timestamp"
replacements="$index$=kibana_sample_data_logs"
query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"$index$\"}}}}}"

Query index kibana_sample_data_logs using replacement and without time constraints

| elasticadhoc 
instance="elastic_cluster"
timestamp_used="false"
timestamp_format=""
timestamp_field="timestamp"
replacements="$index$=kibana_sample_data_logs"
query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"$index$\"}}}}}"

Permissions

danger

Only elevated users should be able to run elasticadhoc as the user can run arbitrary queries. The only restrictions applied while running elasticadhoc are the access restrictions on instances and the user used to create the API token.

By default, the command elasticadhoc is only visible to users with the role elastic_adhoc. Furthermore, the command checks the capabilities of the user running the command. An error message is shown to the user if the capability run_elastic_adhoc is unavailable. Additionally, RBAC on the instance selected by the user is performed. The user must have at least one role configured for the given instance to run any queries against it.