elasticparse

The command elasticparse previews how ElasticSPL would parse a DSL query with the provided user input. elasticparse performs the same actions as elasticadhoc and elasticadhocstats but does not execute the query.

Arguments

argument	required	format	description
query	yes	string	escaped DSL JSON query
timestamp_field	yes	string	field in Elasticsearch results containing the events timestamp
timestamp_used	no	boolean	defines if the time given in the Splunk Search is used for the query
timestamp_format	no	string	python strpftime format string
replacements	no	string	kv-pairs used to replace tokens in query

Examples

Parsing Query with timestamp_used="False" and no replacements

Splunk Search

| elasticparse  
  timestamp_used="False" 
  timestamp_format="" 
  timestamp_field="timestamp" 
  replacements="" 
  query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"kibana_sample_data_logs\"}}}}}" 

Parsed Query

{
   "query":{
      "bool":{
         "must":{
            "match":{
               "index":"kibana_sample_data_logs"
            }
         }
      }
   }
}

Parsing query with timestamp_used="True" and no replacements

Splunk Search

| elasticparse  
  timestamp_used="True" 
  timestamp_format="" 
  timestamp_field="timestamp" 
  replacements="" 
  query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"kibana_sample_data_logs\"}}}}}" 

Parsed Query

{
   "query":{
      "bool":{
         "must":[
            {
               "match":{
                  "_index":"kibana_sample_data_logs"
               }
            },
            {
               "range":{
                  "timestamp":{
                     "gte":1652972940000,
                     "lte":1652976554000,
                     "format":"epoch_millis"
                  }
               }
            }
         ]
      }
   }
}

Parsing Query with timestamp_used="False" and replacements

Splunk Search

| elasticparse  
  timestamp_used="False" 
  timestamp_format="" 
  timestamp_field="timestamp" 
  replacements="" 
  query="{\"query\":{\"bool\":{\"must\":{\"match\":{\"index\":\"kibana_sample_data_logs\"}}}}}" 

Parsed Query

{
   "query":{
      "bool":{
         "must":{
            "match":{
               "index":"kibana_sample_data_logs"
            }
         }
      }
   }
}

Parsing query with timestamp_used="True" and replacements

Splunk Search

| elasticparse  
  timestamp_used="True" 
  timestamp_format="" 
  timestamp_field="timestamp" 
  replacements="$index$=kibana_sample_data_logs" 
  query="{\"query\":{\"bool\":{\"must\":[{\"match\":{\"_index\":\"$index$\"}}]}}}"

Parsed Query

{
   "query":{
      "bool":{
         "must":[
            {
               "match":{
                  "_index":"kibana_sample_data_logs"
               }
            },
            {
               "range":{
                  "timestamp":{
                     "gte":1652972940000,
                     "lte":1652976554000,
                     "format":"epoch_millis"
                  }
               }
            }
         ]
      }
   }
}

Permissions

All users with the role elastic_user can use the command as elasticparse does not fetch any data