Query from kibana in python?

Question

I am starting a little script in Python to create a little GET on a query I made in Kibana. Currently, in Kibana I receive a list of IP with the counts:

I would like to receive this information in Python and I already try with search but I am not sure to understand.

Here is the query in Kibana:

    GET /_search
{
  "size": 0,
  "query": {
      "range": {
        "@timestamp": {
          "gte": 1552922613804,
          "lte": 1552923513804,
          "format": "epoch_millis"
        }
      }
    },
  "aggs": {
    "2": {
      "significant_terms": {
        "field": "origin.keyword",
        "size": 300
      }
    }
  }
}

Is it possible to create the same query in python?

Thanks in advance!

Answer 1

Yes,just convert your query so python can understand. If you have authentication setup for elastic you will need to pass your authentication aswell. (username,password) as tuple. Add this to the requests as (auth=(username,password))

import json
import requests

HEADERS = {
    'Content-Type': 'application/json'
}

uri = "[insert your endpoint]"+"/_search"

query = json.dumps({
  "size": 0,
  "query": {
      "range": {
        "@timestamp": {
          "gte": 1552922613804,
          "lte": 1552923513804,
          "format": "epoch_millis"
        }
      }
    },
  "aggs": {
    "2": {
      "significant_terms": {
        "field": "origin.keyword",
        "size": 300
      }
    }
  }
})

r = requests.get(uri,headers=HEADERS, data=query).json()
print(r)

Answer 2

Here's how you can query ES and convert the results to CSV:

from elasticsearch import Elasticsearch, helpers
import csv
es = Elasticsearch([“Server”])
query={"query": {"query_string" : {"query" : “(something: True)“}}}
index=[“Index”]
l=[]
with open('my.csv','w') as out:
    csv_out=csv.writer(out)
    csv_out.writerow([‘my’, ‘header’])
    for i in index:
        res=es.search(index=i,doc_type="core-config",body=query,_source_include=[“my”, “header”],size="10000")
        for indexes in res['hits']['hits']:
            l.append((indexes['_source’][‘my’],indexes['_source’][‘header’]))
        set_keyid=list(set(l))
        for lis in set_keyid:
            csv_out.writerow(lis)