Overview

elasticfetch - overview

Elasticfetch is a simple tool to export huge amounts of data from elasticsearch.

Currently, this tool is not reliant on the scroll API and in the event where elasticsearch decides to discontinue the support for scroll API, this tool will remain to function properly.

This tool aims to facilitate work flow of threat hunting and data analysis in the event where you need to query huge amount of data without killing the server.

Required Python Packages

pip3 install requests
pip3 install tqdm

Current Features

1. Show index health status
2. Setting Index to fetch from
3. Set main timestamp (This field will be used to sort your data in chronological order)
4. Showing available field names related to your index (Not Hardcoded)
5. Fetching data between two timestamps

How to use

Setting parameters in configuration file

Edit elasticfetch.ini and set the following variables to your own values :

• Protocol (https or http)
• IP address (XXX.XXX.XXX.XXX or domain name)
• port (Usually 9200)
• username (Must have enough privilege to use APIs)
• password

Running elasticfetch

python3 elasticfetch.py