Skip to content

Instantly share code, notes, and snippets.

@joshdevins
Last active October 16, 2019 14:22
Show Gist options
  • Save joshdevins/3b965c7f4933214f91ecd00b7a33aae6 to your computer and use it in GitHub Desktop.
Save joshdevins/3b965c7f4933214f91ecd00b7a33aae6 to your computer and use it in GitHub Desktop.
Extract structured query source from a Elasticsearch slow query log for a given an index pattern
jq -r .message | sed -n '/\[\(\INDEX_PATTERN\)\]\[.*\] .*/p' | sed -n 's/.* source\[\(.*\)\]\, id.*/\1/p' | jq -C .
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment