Last active
November 12, 2019 12:11
-
-
Save joshdevins/0f12ac594db1afd39991311d7d648276 to your computer and use it in GitHub Desktop.
Capture Elasticsearch queries
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # everything | |
| sudo tcpdump -i lo0 -A -n -s 0 'tcp dst port 9200 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # POST only | |
| sudo tshark -i lo0 -Y 'http.request.method == "POST"' -T fields -e http.request.uri -e http.file_data 'tcp dst port 9200' > dump.txt | |
| # then look for search queries | |
| cat dump.txt | grep search | sed -n 's/.*\\n\({\"query\":.*\)\\n/\1/p' | jq -C . |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment