Hi Jochen,
It should give something like that :
curl -s
"http://mygraylog.org/search/universal/relative/terms?query=%2A&range=300&filter=streams%3A55dc68d60cf293c638ddf255&field=status";
| python -mjson.tool
{
"built_query":
"{\"from\":0,\"query\":{\"bool\":{\"must\":{\"match_all\":{}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"timestamp\":{\"from\":\"2016-08-23
15:35:21.889\",\"to\":\"2016-08-23
15:40:21.889\",\"include_lower\":true,\"include_upper\":true}}},{\"query_string\":{\"query\":\"streams:55dc68d60cf293c638ddf255\"}}]}}}},\"aggregations\":{\"gl2_filter\":{\"filter\":{\"bool\":{\"must\":[{\"range\":{\"timestamp\":{\"from\":\"2016-08-23
15:35:21.889\",\"to\":\"2016-08-23
15:40:21.889\",\"include_lower\":true,\"include_upper\":true}}},{\"query_string\":{\"query\":\"streams:55dc68d60cf293c638ddf255\"}}]}},\"aggregations\":{\"gl2_terms\":{\"terms\":{\"field\":\"status\",\"size\":50}},\"missing\":{\"missing\":{\"field\":\"status\"}}}}}}",
"missing": 2,
"other": 8530,
"terms": {
"200": 1600,
"404": 20,
"503": 10
},
"time": 20,
"total": 1630
}
It is what is called termsRelative in the API documentation.
Mathieu
On 08/23/16 12:29, Jochen Schalanda wrote:
Hi Mathieu,
the Graylog REST API changed between Graylog 1.x and Graylog 2.x.
What should the request, you've posted, exactly do?
Cheers,
Jochen
On Tuesday, 23 August 2016 14:14:13 UTC+2, Mathieu Grzybek wrote:
Hello,
I have found that since my upgrade to 2.0 I cannot compute the quick
value widget. It only appears on field called "status".
I don't see any exception on elasticsearch logs. The only messages
found
are in graylog server.log:
[SearchResource] Missing fields parameter. Returning HTTP 400
[SearchResource] Unable to execute search: [reduce]
call example:
curl
"http://mygraylog.org:12900/search/universal/relative/terms?query=%2A&range=300&filter=streams%3A55dc68d60cf293c638ddf255&field=status
<http://mygraylog.org:12900/search/universal/relative/terms?query=%2A&range=300&filter=streams%3A55dc68d60cf293c638ddf255&field=status>"
{"query":"*","begin_column":null,"begin_line":null,"end_column":null,"end_line":null,"message":"Unable
to execute
search","exception_name":"org.elasticsearch.action.search.ReduceSearchPhaseException"}
Is it a reserved word ?
I don't understand the error because a lot of messages of the given
stream contain the requested field.
Thanks,
Mathieu
--
Le capitaine Mathieu GRZYBEK
COMSOPGN / STIG / BCQ
--
You received this message because you are subscribed to the Google
Groups "Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to [email protected]
<mailto:[email protected]>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/29bf680f-c9f6-45cc-bf13-a1f7a19f32a2%40googlegroups.com
<https://groups.google.com/d/msgid/graylog2/29bf680f-c9f6-45cc-bf13-a1f7a19f32a2%40googlegroups.com?utm_medium=email&utm_source=footer>.
For more options, visit https://groups.google.com/d/optout.
--
Le capitaine Mathieu GRZYBEK
COMSOPGN / STIG / BCQ
--
You received this message because you are subscribed to the Google Groups "Graylog
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/57BC7187.8050803%40gendarmerie.interieur.gouv.fr.
For more options, visit https://groups.google.com/d/optout.
Ce message électronique et tous les fichiers attachés qu'il contient sont
confidentiels et destinés exclusivement à l'usage de la personne à laquelle ils
sont adressés. Si vous avez reçu ce message par erreur, merci de le retourner à
son émetteur. La publication, l'usage, la distribution, l'impression ou la
copie non autorisée de ce message et des attachements qu'il contient sont
strictement interdits.
En cas d'urgence, composez le 17 ou le 112.
Afin de contribuer au respect de l'environnement, merci de n'imprimer cet
e-mail qu'en cas de necessite.
This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual to whom it is addressed. If you have
received this email in error please send it back to the person that sent it to
you. Unauthorized publication, use, dissemination, forwarding, printing or
copying of this email and its associated attachments is strictly prohibited.
In case of emergency, dial number 17 or 112.
To contribute to the environmental protection, please print this e-mail only if
necessary.
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/57BC7187.8050803%40gendarmerie.interieur.gouv.fr.
For more options, visit https://groups.google.com/d/optout.
