3 ms·

Not sure what kind of queries you want to do, but Elasticsearch has a fairly extensive Query DSL that'll let you do all sorts of aggregations: https://www.elas

by glial 11y ago

Not sure what kind of queries you want to do, but Elasticsearch has a fairly extensive Query DSL that'll let you do all sorts of aggregations: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html https://www.elastic.co/guide/en/elasticsearch/reference/curr... There is a Python implementation that makes creating complex queries pretty easy: https://github.com/elastic/elasticsearch-dsl-py https://github.com/elastic/elasticsearch-dsl-py I agree with the criticisms of Kibana, but I have had no problems querying Elasticsearch directly. It also supports scripted queries if the built-in aggregations aren't enough. Of course, then you have to build your own visualizations with the results...

meowface 11y ago
I'm not sure I'd consider that a DSL. It's unwieldy to write a full JSON object for every one-off query I want to do. Using one of their examples, this: { "query": { "filtered": { "query": { "bool": { "must": [{"match": {"title": "python"}}], "must_not": [{"match": {"description": "beta"}}] } }, "filter": {"term": {"category": "search"}} } }, "aggs" : { "per_tag": { "terms": {"field": "tags"}, "aggs": { "max_lines": {"max": {"field": "lines"}} } } } } would be the following Splunk query: title=python description!=beta | stats max(lines) by tags It would be nice if there was some kind of query compiler that could generate ES JSON from an expressive query language.
- illumen 11y ago
  The linked python dsl does pretty well. Not as nice as your reduced dsl but. s = Search(using=client, index="my-index") \ .filter("term", category="search") \ .query("match", title="python") \ .query(~Q("match", description="beta"))
- deleted 11y ago
  [deleted]
- michaelcampbell 11y ago
  https://github.com/NLPchina/elasticsearch-sql/ https://github.com/NLPchina/elasticsearch-sql/ does exactly that with a reasonably good subset of SQL and ES query language mixed in. It operates in 2 modes; in one it runs the query, in another it spits back out what the equivalent ES JSON query is. We use this as a quick prototyping tool and modify the ES query as needed, as most of us here still "think" in SQL for a lot of things.

by glial 11y ago

meowface 11y ago

I'm not sure I'd consider that a DSL. It's unwieldy to write a full JSON object for every one-off query I want to do. Using one of their examples, this: { "query": { "filtered": { "query": { "bool": { "must": [{"match": {"title": "python"}}], "must_not": [{"match": {"description": "beta"}}] } }, "filter": {"term": {"category": "search"}} } }, "aggs" : { "per_tag": { "terms": {"field": "tags"}, "aggs": { "max_lines": {"max": {"field": "lines"}} } } } } would be the following Splunk query: title=python description!=beta | stats max(lines) by tags It would be nice if there was some kind of query compiler that could generate ES JSON from an expressive query language.

illumen 11y ago
The linked python dsl does pretty well. Not as nice as your reduced dsl but. s = Search(using=client, index="my-index") \ .filter("term", category="search") \ .query("match", title="python") \ .query(~Q("match", description="beta"))
deleted 11y ago
[deleted]
michaelcampbell 11y ago
https://github.com/NLPchina/elasticsearch-sql/ https://github.com/NLPchina/elasticsearch-sql/ does exactly that with a reasonably good subset of SQL and ES query language mixed in. It operates in 2 modes; in one it runs the query, in another it spits back out what the equivalent ES JSON query is. We use this as a quick prototyping tool and modify the ES query as needed, as most of us here still "think" in SQL for a lot of things.