elastic.go

package main

import(
        "fmt"
        "bytes"
        "encoding/json"
        bjson "github.com/bitly/go-simplejson"
        elastic "gopkg.in/olivere/elastic.v3"
)

func main(){
        client, err := elastic.NewClient(elastic.SetURL("http://10.2.16.5:9200"))
        if err != nil {
                // Handle error
                panic(err)
        }
  exists, err := client.IndexExists("fluentd").Do()
        fmt.Println(exists)
  if err != nil {
    // Handle error
    panic(err)
  }
        res := elastic.NewQueryStringQuery("august-barbecue")

        searchResult,err := client.Search().
      Index("fluentd").   // search in index "twitter"
      Query(res).   // specify the query
     // sort by "user" field, ascending
     From(0).Size(5).   // take documents 0-9
    Pretty(true).       // pretty print request and response JSON
    Do()                // execute
  type docker struct {
 container_id string
}
type kuber struct{                                                                                              
namespace string                                                                                                
pod_id string                                                                                                   
pod_name string                                                                                                 
container_name string                                                                                           
label map[string]string                                                                                         
host string                                                                                                     
}                                                                                                               
type flulog struct {                                                                                            
log string                                                                                                      
stream string                                                                                                   
time string                                                                                                     
docker map[string]string                                                                                        
kubernetes map[string]string                                                                                    
tag string                                                                                                      
}                                                                                                               
                                                                                                                
for _, item := range searchResult.Hits.Hits {                                                                   
        var jaffa flulog                                                                                        
        buf := bytes.NewBuffer([]byte(*item.Source))                                                            
   js, _ := bjson.NewFromReader(buf)                                                                            
   fmt.Println(js.Get("log").MustString())                                                                      
   fmt.Println(js.Get("kubernetes").Get("pod_name").MustString())                                               
   err := json.Unmarshal([]byte(*item.Source),&jaffa)                                                           
                if err != nil {                                                                                 
                        fmt.Println(err)                                                                        
                }                                                                                               
                                                                             
 fmt.Printf("Tweet by %s \n", jaffa)                                                                            
 fmt.Println(jaffa.kubernetes)                                                                                  
}                                                                                                               
                                                                      
fmt.Println(searchResult.TotalHits())                                                                           
} 

sample.json

{
	"log": "[01/Apr/2016:12:03:47 +0000] - 10.2.16.0 - - - 400 - \"\\x22\\xBCz\\xCE\\xB7<\\xC6tW0|\\x22\\xDDC\\x851\\xB3VCQlm\\xD0#\\x5C\\xF9\\xB7W\\x96aa\\x93x\\xF5\\x9CEa\\xC2\\xBA6\\x90\\x07Q\\x15\\x5C\\xC5\\x06\\xA5\\x94\\xA9$A\\x95\\xA4=4\\x90\\xC1L\\xA9\\xF2\\x94\\x12\\xC1\" - 323 - \"-\" - \"-\" - \"_\" - - - - - - - 0.037\n",
	"stream": "stderr",
	"time": "2016-04-01T12:03:47.303862661Z",
	"docker": {
		"container_id": "626b2683f69c3c6af57f19d2f0fd823ed6424ae829dc964b832309a9dd031028"
	},
	"kubernetes": {
		"namespace_name": "deis",
		"pod_id": "36b01c8b-f6b3-11e5-b98d-061344a18fd5",
		"pod_name": "deis-router-s2t6b",
		"container_name": "deis-router",
		"labels": {
			"app": "deis-router"
		},
		"host": "ip-10-0-0-14.us-west-2.compute.internal"
	},
	"tag": "kubernetes.var.log.containers.deis-router-s2t6b_deis_deis-router-626b2683f69c3c6af57f19d2f0fd823ed6424ae829dc964b832309a9dd031028.log"
}

Tweet by { map[] map[] }