Monday, February 27, 2017

Unix like " tail -f " command for Elasticsearch (using Python)


Humble implementation of a Unix like "tail" command for Elasticsearch using Python.

Tested with Logstash indexed content.


$ git clone
$ cd elasticsearch-python/
$ python

Basic usage

The only mandatory parameter is --endpoint


$ python --endpoint

By default the last 10 lines of log are displayed. You can change this behaviour with --docs or -n switch.

Example: To display the last 50 lines.

$ python --endpoint -n 50

To have continuous output use -f or --nonstop


$ python --endpoint -f

By default ES type = apache is used. You can select other types with --type


$ python --endpoint --type java

$ python --endpoint --type apache


By default the more recent Logstash Index is used. Optionally you can specify the desired index name using --index


$ python --endpoint --index logstash-2016.08.08

When using --type java there are two other selectors available: --javalevel and --javaclass


$ python --endpoint --type java --javalevel ERROR

$ python --endpoint --type java --javaclas

When using --type apache there are two other selectors available: --httpresponse and --httpmethod


$ python --endpoint --type apache --httpresponse 404

$ python --endpoint --type apache --httpmethod POST

To display the native Elasticsearch timestamp of each event use --showheaders (Convenient when adding a |grep on the output to do additional filtering):


python --endpoint --showheaders

To display events belonging to a particular host and ignore the rest use --hostname


$ python --endpoint --hostname

Connection modes

The default protocol is HTTP (Port 80) but any other port can be specified under --endpoint

Example for HTTPS:

$ python -f --endpoint 


$ python -f --endpoint

Example for Elasticsearch native port:

$ python -f --endpoint

Known issues

You need elasticsearch Python module installed

If you don't have it, run 'sudo pip install elasticsearch' to install it.

TLS error: "elasticsearch.exceptions.ConnectionError: ConnectionError(('Connection failed.', CannotSendRequest())) caused by: ConnectionError(('Connection failed.', CannotSendRequest()))"

Update urllib3 running 'sudo pip install --upgrade urllib3' or use a non HTTPS Endpoint URL.

Error: "check_index: No index found! Exiting"

The current script only cares for indices with the "logstash-" prefix. If you use any other prefix to index your logs it will fail.
If you think this shouldn't be this way please let me know in the comments.


Done for fun. Feel free to comment on bugs or additional desired features.

Thank you!


  1. Great Article. Thank you for sharing! Really an awesome post for every one.

    IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes, while specialists like the enjoyment in interfering with innovation. For experts, it's an alternate ball game through and through. Smaller than expected IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble. Final Year Project Domains for IT It gives you tips and rules that is progressively critical to consider while choosing any final year project point.

    Spring Framework has already made serious inroads as an integrated technology stack for building user-facing applications. Spring Framework Corporate TRaining the authors explore the idea of using Java in Big Data platforms.
    Specifically, Spring Framework provides various tasks are geared around preparing data for further analysis and visualization. Spring Training in Chennai

  2. PHP advancement is a well-known scripting language that is utilized to make intelligent and dynamic sites. Today, most business sites are made by utilizing php application development as it accompanies profoundly practical highlights and ease of use. So, organizations ready to make a customer's site with amazing information the executives highlights will require to recruit php development company. Our prime php website development improvement administrations start with understanding the client needs and stretches out to database driven top of the line custom undertaking web frameworks. Recruit devoted PHP engineers from Colan Infotech to plan php web development utilizing Photoshop, Flash etc. The php development India advancement administrations we offer are recorded underneath:

  3. Thank you for the informative article. ufabet1688 Your writing style is interesting. I liked how you explained and I really enjoyed reading this post.

  4. The Casino at The Cosmopolitan of Las Vegas - MapYRO
    Casino 충청북도 출장마사지 at The Cosmopolitan 당진 출장마사지 of Las 파주 출장마사지 Vegas 동두천 출장샵 - MapYRO 계룡 출장샵

  5. Thanks for this great info of yours. This is so much a lot to do with my life. Lifesaver. Keep sharing with us. divorce lawyer

  6. Great write-up. Thanks for sharing. Keep up the good work! nondenominational church