jbleonesio created page: Elasticsearch authored by Jean-Baptiste Leonesio's avatar Jean-Baptiste Leonesio
...@@ -149,7 +149,7 @@ I found some existing tools: ...@@ -149,7 +149,7 @@ I found some existing tools:
/usr/sbin/estab -indices web-lyon -delimiter "," -f "timestamp time_spent src_ip ret_code total_bytes http_method url login hierarchycode_nexthop mime_type group u1 u2 u3 u4 u5 u6 u7 u8 u9 u10 u11 u12 u13 u14 u15 u16 u17 u18 u19 u20 u21 u22 u23 u24 u25 u26 u27 user_agent" /usr/sbin/estab -indices web-lyon -delimiter "," -f "timestamp time_spent src_ip ret_code total_bytes http_method url login hierarchycode_nexthop mime_type group u1 u2 u3 u4 u5 u6 u7 u8 u9 u10 u11 u12 u13 u14 u15 u16 u17 u18 u19 u20 u21 u22 u23 u24 u25 u26 u27 user_agent"
``` ```
But neither of them seems give acceptable performance. But neither of them seems to give acceptable performance.
So I rolled my own Bash script using the efficient [Scroll API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-scroll.html) and [jq](http://stedolan.github.io/jq) for JSON parsing: So I rolled my own Bash script using the efficient [Scroll API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-scroll.html) and [jq](http://stedolan.github.io/jq) for JSON parsing:
```bash ```bash
... ...
......