Post

Hi  Dan,

We've been using your script to check on the status of our elastic search indexes and then it dawned on me we could use the same script to check on the data inside the indexes, but to do so needed the ability to POST the search terms. 

So; I've added an option -j allowing JSON data to be passed. 
I've also added -o to return an OK in the event the regex isn't matched - If I'm looking for 404s and I get none returned, that's a good thing!

This is the first bit of ruby I've really hacked with so I hope it's ok. It's also the first GitHub Pull request I've made so apologies if's this is all wrong..

Here's an example of how I'm using the 2 extra options.  - look in an index for any 404s that have occured in the last 5 minutes, and format that data to be returned in a single line (e.g. suitable for a bar chart). I suspect there's a neater way of doing this that I've not found yet. 

./check_http_json.rb -o -u http://ourElasticSearchServer:9200/logstash-2014.01.26/_search?pretty -E count -w 8 -c 10 -j '{"facets": {"0": {"date_histogram": {"field": "@timestamp","interval": "10m"},"facet_filter": {"fquery": {"query": {"filtered": {"query": {"query_string": {"query": "@source_host:\"TrafficManagers\" AND @fields.verb:\"GET\" AND @fields.pool:\"pool-document-download\" AND @fields.response:\"404\""}},"filter": {"bool": {"must": [{"match_all": {}},{"range": {"@timestamp": {"from": 1390595488856,"to": 1390595788856}}},{"bool": {"must": [{"match_all": {}}]}}]}}}}}}}},"size": 0}'

I've also written a quick and dirty bash wrapper script that allows me to replace the date fields in the JSON with 'Now' values so it can be run easily from Nagios.

Rich