Trying to make heads or tails of the check_elasticsearch.py check as suggested here: https://support.nagios.com/forum/viewto ... 37&t=50451
One form of the command allows for use of saved "filters" -- does anyone know how to save a filter so as to be able to reference it with this command?
The Python code is working, but results are dodgy because of my inability to figure out how to create a saved filter, AND because I lack the Lucene-Fu to cobble together a query. Strange errors....
Here's an example of my failures:
Code: Select all
}[root@rbbusnagios1t libexec]#/usr/local/nagios/libexec/check_elasticsearch.py --host "http://rbbusnls1t:9200/" --index "filebeat-2018.10.10" --query "message:'ARCHIVE action failed' AND @timestamp:'[[now-24h TO now]]'" --warning 1 --critical 2
Error: Exception: TransportError(400, u'{"count":0,"_shards":{"total":5,"successful":0,"failed":5,"failures":[{"index":"filebeat-2018.10.10","shard":0,"status":400,"reason":"BroadcastShardOperationFailedException[[filebeat-2018.10.10][0] ]; nested: QueryParsingException[[filebeat-2018.10.10] Failed to parse]; nested: IllegalArgumentException[Invalid format: \\"\'\\"]; "},{"index":"filebeat-2018.10.10","shard":1,"status":400,"reason":"BroadcastShardOperationFailedException[[filebeat-2018.10.10][1] ]; nested: QueryParsingException[[filebeat-2018.10.10] Failed to parse]; nested: IllegalArgumentException[Invalid format: \\"\'\\"]; "},{"index":"filebeat-2018.10.10","shard":2,"status":400,"reason":"BroadcastShardOperationFailedException[[filebeat-2018.10.10][2] ]; nested: QueryParsingException[[filebeat-2018.10.10] Failed to parse]; nested: IllegalArgumentException[Invalid format: \\"\'\\"]; "},{"index":"filebeat-2018.10.10","shard":3,"status":400,"reason":"BroadcastShardOperationFailedException[[filebeat-2018.10.10][3] ]; nested: QueryParsingException[[filebeat-2018.10.10] Failed to parse]; nested: IllegalArgumentException[Invalid format: \\"\'\\"]; "},{"index":"filebeat-2018.10.10","shard":4,"status":400,"reason":"BroadcastShardOperationFailedException[[filebeat-2018.10.10][4] ]; nested: QueryParsingException[[filebeat-2018.10.10] Failed to parse]; nested: IllegalArgumentException[Invalid format: \\"\'\\"]; "}]}}')
[root@rbbusnagios1t libexec]#