Skip to main content
Version: 1.0.0

Usage

ElasticSPL allows for dynamic definition of time ranges and token replacements in DSL queries. This is done for both elasticadhoc and elasticquery. To test on how a DSL query is parsed the command elasticparse can be used.

Time Range

To query logs in Elastic Search in a similar fashion as in Splunk the timerange picker from Splunk searches can be used to add time constraints to DSL queries. This is available for DSL queries regardless of whether the query already contains time constraints. To enable dynamic time range parsing the query has to be run with timestamp_used set to True and timestamp_field provided.

If a DSL query already includes the key defined as timestamp_field the values $earliest$ and $latest$ are replaced with the earliest and latest time of the current Splunk search

Original Parsed
{
"query":{
"bool":{
"must":{
"match":{
"index":"kibana_sample_data_logs"
}
},
"filter":{
"range":{
"timestamp":{
"gte":"$earliest$",
"lte":"$latest$"
}
}
}
}
}
}
{
"query":{
"bool":{
"must":{
"match":{
"index":"kibana_sample_data_logs"
}
},
"filter":{
"range":{
"timestamp":{
"gte":1652860500000,
"lte":1652874946000,
"format":"epoch_millis"
}
}
}
}
}
}

Replacements

Replacements can be used to utilise a single query for different cases. As example is it possible to replace a filter for a username dynamically. Values that are replaced in a DSL query have to be marked as such in surrounding the value with $. The replacements are provided in a key value format. For the given query the replacements are defined as following:

$ip$=120.49.143.213,$response$=503

Original Parsed
{
"query":{
"bool":{
"must":[
{
"match":{
"index":"kibana_sample_data_logs"
}
},
{
"match":{
"ip":"$ip$"
}
},
{
"match":{
"response":"$response$"
}
}
]
}
}
}
{
"query":{
"bool":{
"must":[
{
"match":{
"index":"kibana_sample_data_logs"
}
},
{
"match":{
"ip":"120.49.143.213"
}
},
{
"match":{
"response":"503"
}
}
]
}
}
}