Add Elasticsearch indexes variable ...

[nzlosh]

... to avoid querying indexes which do not have the expected document fields.

Problem description

When queries are run against the Elasticsearch cluster, no index option is provided. In this case, the underlying library defaults to "_all". This is problematic when the ES cluster has indexes which don't contain documents with the field @timestamp. An Exception is raised by Elasticsearch like the example below: (query masked for privacy reasons)

Caused by: org.elasticsearch.search.SearchParseException: [kibana-int][0]: query[XXXXXXXX],from[-1],size[1]: Parse Failure [No mapping found for [@timestamp] in order to sort on]

Fix

By explicitly providing the list of indexes to run the query against, the above error is avoid. The indexes variable is optional for the logstash configuration. If the variable is not set in the configuration, an empty string is supplied by the plugin and the underlying library will use the original behaviour of querying "_all".

[jdve]

👍

[elasticsearch-release]

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run; then say 'jenkins, test it'.

[ghost]

+1

[purbon]

Apologies for taking such a long time to come back here, I'm doing some mantainance on this plugin and will be closing this in benefit of #31 as it provides a similar solution but include some other stuff into also. Thanks a lot for your contribution. Will be soon releasing a new version that will include all the pending requests here.