Dumping Logs Belonging to Specific API Proxies

Dump Operation

The following command filters the Elasticsearch data stream according to the query in the --searchBody field and dumps it to the /tmp/es_backup folder.

not

The --searchBody parameter filters logs by specific API Proxy IDs. Replace <INDEX_KEY>, <API_PROXY_ID>, <USERNAME>, <PASSWORD>, <ELASTIC_IP>, and <ELASTIC_PORT> in the command with the values for your environment.

multielasticdump --direction=dump \
  --match='apinizer-log-apiproxy-<INDEX_KEY>' \
  --matchType=datastream \
  --input=https://<USERNAME>:<PASSWORD>@<ELASTIC_IP>:<ELASTIC_PORT> \
  --ignoreType='mapping,settings,template' \
  --output=/tmp/es_backup \
  --searchBody="{\"query\": {\"match\": { \"api\": \"<API_PROXY_ID>\" }}}" \
  --overwrite \
  --ignoreChildError=true \
  --ignoreMapping=true \
  --ignoreSettings=true \
  --ignoreTemplate=true \
  --ignoreAlias=true

uyarı

If you get the self-signed certificate in certificate chain error while taking the dump, prefix the command with NODE_TLS_REJECT_UNAUTHORIZED=0:

NODE_TLS_REJECT_UNAUTHORIZED=0 multielasticdump --direction=dump \
  --match='apinizer-log-apiproxy-<INDEX_KEY>' \
  --matchType=datastream \
  --input=https://<USERNAME>:<PASSWORD>@<ELASTIC_IP>:<ELASTIC_PORT> \
  --ignoreType='mapping,settings,template' \
  --output=/tmp/es_backup \
  --searchBody="{\"query\": {\"match\": { \"api\": \"<API_PROXY_ID>\" }}}" \
  --overwrite \
  --ignoreChildError=true \
  --ignoreMapping=true \
  --ignoreSettings=true \
  --ignoreTemplate=true \
  --ignoreAlias=true

Installation

CentOS/RHEL

yum install npm
npm install elasticdump
npm install --no-bin-links elasticdump

Ubuntu

apt update
apt install npm
npm install elasticdump
npm install --no-bin-links elasticdump

Detailed Information

bilgi

You can check the elasticsearch-dump GitHub page for more information.