For When You Can't Have The Real Thing
[ start | index | login ]
start > ELK > Querying For Email Addresses

Querying For Email Addresses

Created by dave. Last edited by dave, 7 years and 271 days ago. Viewed 1,907 times. #1
[edit] [rdf]


I have a standard stream of sendmail logs that are being streamed into Elasticsearch more or less unfiltered using only

match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:syslog_message}" }
...way of doing things.

I want to search the resulting indexes for a particular email address.


To search for, query for: dave AND

This is a hack but it should return what you want. (Maybe with lots of stuff you don't want, I don't know. But at least I can find it now.)

no comments | post comment
This is a collection of techical information, much of it learned the hard way. Consider it a lab book or a /info directory. I doubt much of it will be of use to anyone else.

Useful: | Copyright 2000-2002 Matthias L. Jugel and Stephan J. Schmidt