https://wiki.ixheim.de/index.php?action=history&feed=atom&title=Elasticsearch_Cheat_Sheet_%28pfELK%29
Elasticsearch Cheat Sheet (pfELK) - Versionsgeschichte
2026-06-29T06:07:23Z
Versionsgeschichte dieser Seite in Xinux Wiki
MediaWiki 1.35.1
https://wiki.ixheim.de/index.php?title=Elasticsearch_Cheat_Sheet_(pfELK)&diff=64624&oldid=prev
Thomas.will: /* Letzte Dokumente (egal welcher Namespace) */
2025-09-13T17:52:34Z
<p><span dir="auto"><span class="autocomment">Letzte Dokumente (egal welcher Namespace)</span></span></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="de">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 13. September 2025, 17:52 Uhr</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l15" >Zeile 15:</td>
<td colspan="2" class="diff-lineno">Zeile 15:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Letzte Dokumente (egal welcher Namespace) ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Letzte Dokumente (egal welcher Namespace) ==</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* curl -u elastic:123Start$ -<del class="diffchange diffchange-inline">k \</del></div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* curl -u elastic:123Start$ -"https://localhost:9200/.ds-logs-pfelk-*/_search?pretty" -H 'Content-Type: application/json' -d '{</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>"https://localhost:9200/.ds-logs-pfelk-*/_search?pretty" <del class="diffchange diffchange-inline">\</del></div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> </ins>"size": 5,</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>-H 'Content-Type: application/json' -d '{</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> </ins>"sort": [ { "@timestamp": "desc" } ],</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline"> </del>"size": 5,</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> </ins>"_source": ["@timestamp","log.syslog.appname","data_stream.namespace","message"]</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline"> </del>"sort": [ { "@timestamp": "desc" } ],</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline"> </ins>}'</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline"> </del>"_source": ["@timestamp","log.syslog.appname","data_stream.namespace","message"]</div></td><td colspan="2"> </td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>}'</div></td><td colspan="2"> </td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Suche nach Keyword (z. B. suricata) ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Suche nach Keyword (z. B. suricata) ==</div></td></tr>
</table>
Thomas.will
https://wiki.ixheim.de/index.php?title=Elasticsearch_Cheat_Sheet_(pfELK)&diff=64623&oldid=prev
Thomas.will: Die Seite wurde neu angelegt: „== Indices anzeigen == * curl -u elastic:123Start$ -k "https://localhost:9200/_cat/indices?v" == Alle Data Streams anzeigen == * curl -u elastic:123Start$ -k…“
2025-09-13T17:52:10Z
<p>Die Seite wurde neu angelegt: „== Indices anzeigen == * curl -u elastic:123Start$ -k "https://localhost:9200/_cat/indices?v" == Alle Data Streams anzeigen == * curl -u elastic:123Start$ -k…“</p>
<p><b>Neue Seite</b></p><div>== Indices anzeigen ==<br />
* curl -u elastic:123Start$ -k "https://localhost:9200/_cat/indices?v"<br />
<br />
== Alle Data Streams anzeigen ==<br />
* curl -u elastic:123Start$ -k "https://localhost:9200/_cat/data_stream?v"<br />
<br />
== Letzte Dokumente aus Suricata ==<br />
* curl -u elastic:123Start$ -k \<br />
"https://localhost:9200/.ds-logs-pfelk-suricata-*/_search?pretty" \<br />
-H 'Content-Type: application/json' -d '{<br />
"size": 5,<br />
"sort": [ { "@timestamp": "desc" } ],<br />
"_source": ["@timestamp","suricata.eve.alert.signature","source.ip","destination.ip","event.type"]<br />
}'<br />
<br />
== Letzte Dokumente (egal welcher Namespace) ==<br />
* curl -u elastic:123Start$ -k \<br />
"https://localhost:9200/.ds-logs-pfelk-*/_search?pretty" \<br />
-H 'Content-Type: application/json' -d '{<br />
"size": 5,<br />
"sort": [ { "@timestamp": "desc" } ],<br />
"_source": ["@timestamp","log.syslog.appname","data_stream.namespace","message"]<br />
}'<br />
<br />
== Suche nach Keyword (z. B. suricata) ==<br />
* curl -u elastic:123Start$ -k "https://localhost:9200/_search?q=suricata&pretty"<br />
<br />
== Index löschen (Beispiel suricata von heute) ==<br />
* curl -u elastic:123Start$ -k -XDELETE "https://localhost:9200/.ds-logs-pfelk-suricata-2025.09.13-000001"<br />
<br />
== Index-Template (Übersicht) ==<br />
* curl -u elastic:123Start$ -k "https://localhost:9200/_cat/templates?v"<br />
<br />
== Cluster-Health ==<br />
* curl -u elastic:123Start$ -k "https://localhost:9200/_cluster/health?pretty"</div>
Thomas.will