Search
for all logs against host root:
{
    "from": 0,
    "size": 50,
    "sort": [{
        "timestamp": "desc"
    },
    {
        "seq": "desc"
    }],
    "query": {
        "constant_score": {
            "filter": {
                "and": [{
                    "terms": {
                        "level": ["error", "warn", "info"]
                    }
                },
                {
                    "term": {
                        "host": "root"
                    }
                }]
            }
        }
    }
}


{
    "from": 0,
    "sort": {
        "timestamp": "desc"
    }
    "size": 5000,
    "query": {
        "constant_score": {
            "filter": {
                "and": [{
                    "term": {
                        "host": "root"
                    }
                },
                {
                    "terms": {
                        "level": ["error", "warn", "info"]
                    }
                }]
            }
        }
    },
}


{
    "took": 193,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 19,
        "max_score": null,
        "hits": [{
            "_index": "fon",
            "_type": "log",
            "_id": "8KTYz-eRTlKAXyYLLUYX8g",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307019,
                "timestamp": "2011-11-11T21:21:06+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "SyncThread:0",
                "message": "Established session 0x1339479278c0003 with negotiated timeout 30000 for client /0:0:0:0:0:0:0:1%0:58357",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046466000, "1321046012307019"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "R9xKy6k5TLGmvgvkPPYvFg",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307018,
                "timestamp": "2011-11-11T21:21:06+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181",
                "message": "Client attempting to establish new session at /0:0:0:0:0:0:0:1%0:58357",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046466000, "1321046012307018"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "Riw_ZjRoQ2O_up7T2PSShw",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307017,
                "timestamp": "2011-11-11T21:21:06+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181",
                "message": "Accepted socket connection from /0:0:0:0:0:0:0:1%0:58357",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046466000, "1321046012307017"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "-X19myjuTXSFrhKVqFM2tA",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307016,
                "timestamp": "2011-11-11T21:18:34+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.PrepRequestProcessor",
                "thread": "ProcessThread:-1",
                "message": "Processed session termination for sessionid: 0x1339479278c0002",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046314000, "1321046012307016"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "I6w5B80_RQG5Wfm3YWf_rw",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307015,
                "timestamp": "2011-11-11T21:18:34+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.ZooKeeperServer",
                "thread": "SessionTracker",
                "message": "Expiring session 0x1339479278c0002, timeout of 30000ms exceeded",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046314000, "1321046012307015"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "4nixsFrATw2XCq7wQUd2EQ",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307014,
                "timestamp": "2011-11-11T21:18:05+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181",
                "message": "Closed socket connection for client /fe80:0:0:0:0:0:0:1%1:58339 which had sessionid 0x1339479278c0002",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046285000, "1321046012307014"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "BcIIfDMpROujpNVDsW0tCg",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307013,
                "timestamp": "2011-11-11T21:18:05+0000",
                "level": "WARN",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181",
                "message": "EndOfStreamException: Unable to read additional data from client sessionid 0x1339479278c0002, likely client has closed socket",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046285000, "1321046012307013"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "kEQoS7bPQGu1ObkE_Dap8Q",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307012,
                "timestamp": "2011-11-11T21:17:47+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "SyncThread:0",
                "message": "Established session 0x1339479278c0002 with negotiated timeout 30000 for client /fe80:0:0:0:0:0:0:1%1:58339",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046267000, "1321046012307012"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "urBWtjpxTJmhMFOmdQ6LNg",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307011,
                "timestamp": "2011-11-11T21:17:45+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181",
                "message": "Client attempting to establish new session at /fe80:0:0:0:0:0:0:1%1:58339",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046265000, "1321046012307011"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "LzyoQPDUR4S9yUvC-Um_mg",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1321046012307010,
                "timestamp": "2011-11-11T21:17:44+0000",
                "level": "INFO",
                "logger": "org.apache.zookeeper.server.NIOServerCnxn",
                "thread": "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181",
                "message": "Accepted socket connection from /fe80:0:0:0:0:0:0:1%1:58339",
                "properties": {
                    "bundle.name": "org.fusesource.fabric.fabric-linkedin-zookeeper",
                    "bundle.version": "1.1.0.SNAPSHOT",
                    "bundle.id": "42"
                }
            },
            "sort": [1321046264000, "1321046012307010"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "jsCh4eP5TumgmQXiTs75AA",
            "_score": null,
            "_source": {
                "host": "root",

Response
 {
    "took": 2,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 2,
        "max_score": null,
        "hits": [{
            "_index": "fon",
            "_type": "log",
            "_id": "tRi4kKQ0RkiD--xKYD4B6w",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1320689694674002,
                "timestamp": "2011-11-07T13:14:55-0500",
                "level": "INFO",
                "logger": "org.elasticsearch.cluster.metadata",
                "thread": "elasticsearch[root]clusterService#updateTask-pool-19-thread-1",
                "message": "[root] [fon] update_mapping [log] (dynamic)",
                "properties": {
                    "bundle.name": "org.fusesource.fon.fon-elasticsearch",
                    "bundle.version": "1.0.0.SNAPSHOT",
                    "bundle.id": "59"
                }
            },
            "sort": [1320689695000, "1320689694674002"]
        },
        {
            "_index": "fon",
            "_type": "log",
            "_id": "eqcpDfqSTMCic4qLPKr4MQ",
            "_score": null,
            "_source": {
                "host": "root",
                "seq": 1320689694674001,
                "timestamp": "2011-11-07T13:14:55-0500",
                "level": "INFO",
                "logger": "org.elasticsearch.cluster.metadata",
                "thread": "elasticsearch[root]clusterService#updateTask-pool-19-thread-1",
                "message": "[root] [fon] update_mapping [evt] (dynamic)",
                "properties": {
                    "bundle.name": "org.fusesource.fon.fon-elasticsearch",
                    "bundle.version": "1.0.0.SNAPSHOT",
                    "bundle.id": "59"
                }
            },
            "sort": [1320689695000, "1320689694674001"]
        }]
    }
}


To search
for new log entries since the last query:
{
    "from": 0,
    "size": 10000,
    "sort": [{
        "timestamp": "asc"
    },
    {
        "seq": "asc"
    }],
    "query": {
        "constant_score": {
            "filter": {
                "and": [{
                    "terms": {
                        "level": ["error", "warn", "info"]
                    }
                },
                {
                    "term": {
                        "host": "root"
                    }
                },
                {
                    "range": {
                        "seq": {
                            "gt": 1320689694674002
                        }
                    }
                }]
            }
        }
    }
}