search

brunotm / elasticsplunk

A Search command to explore Elasticsearch data within Splunk.
MIT License
40 stars 25 forks source link

timestamp doesn't work with the format "fields.release_date" #24

Open lveronique opened 6 years ago

lveronique commented 6 years ago

the timestamp works like =>tsfield="timestamp" but doesn't work like =>tsfield="fields.release_date" ===example dataset=== { "_index": "movies", "_type": "movie", "_id": "40", "_version": 1, "_score": 2, "_source": { "fields": { "directors": [ "Joss Whedon" ], "release_date": "2015-04-29T00:00:00Z", "genres": [ "Action", "Adventure", "Fantasy", "Sci-Fi" ], "image_url": "......", "title": "The Avengers: Age of Ultron", "rank": 40, "year": 2015, "actors": [ "Scarlett Johansson", "Chris Hemsworth", "James Spader" ] }, "id": "tt2395427", "type": "add" }, "fields": { "fields.release_date": [ "2015-04-29T00:00:00.000Z" ] } }

External search command 'ess' returned error code 1. Script output = "error_message=KeyError at ".../bin/elasticsplunk.py", line 188 : u'fields.release_date' "