#!/usr/bin/python
from datetime import datetime
from elasticsearch import Elasticsearch
import pprint
import time
import sys
 
total = len(sys.argv)
cmdargs = str(sys.argv)
index="*";
limit=100;
oldestDate="now";
earliestDate="now-1d";
defaultField="message";
query="*";
for i in xrange(total):
   opt = str (sys.argv[i]);
   if (  opt.startswith("index") ):
      index= str (sys.argv[i]).split("=")[1];
   elif (  opt.startswith("query") ):
      query= str (sys.argv[i]).split("=")[1];
   elif (  opt.startswith("field") ):
      defaulField= str (sys.argv[i]).split("=")[1];
   elif (  opt.startswith("oldest") ):
      oldestDate= str (sys.argv[i]).split("=")[1];
   elif (  opt.startswith("earl") ):
      earliestDate= str (sys.argv[i]).split("=")[1];
   elif (  opt.startswith("limit") ):
      limit= str (sys.argv[i]).split("=")[1];
   
pp = pprint.PrettyPrinter(indent=4)
es = Elasticsearch()
body = {
      "size": limit,
      "query": {
         "filtered" : {
            "query": {
                  "query_string" : {
                        "default_field" : defaultField,
                        "query" : query
                  }
            },
            "filter" : {
                   "range" : {
                       "@timestamp": {
                           "lt" : earliestDate,
                           "gt" : oldestDate
                       }
                   }
            }
        }
       } 
   }
#pp.pprint(body);
res = es.search(size=limit, index=index, body=body);
print("\"_time\",\"_raw\",\"index\",\"type\"");
#pp.pprint(res);
#date_time = '2014-12-21T16:11:18.419Z'
pattern = '%Y-%m-%dT%H:%M:%S.%fZ'

for hit in res['hits']['hits']:
   hit["_source"][defaultField] = hit["_source"][defaultField].replace('"',' ');
   epochTimestamp = hit['_source']['@timestamp'];
   hit['_source']['_epoch'] = int(time.mktime(time.strptime(epochTimestamp, pattern)))
   hit['_source']["_raw"]=hit['_source'][defaultField]
   print("%(_epoch)s,\"%(_raw)s\"," % hit["_source"] + 
         "\"%(_index)s\",\"%(_type)s\"" % hit
         )
#test development branch

@@ -118,16 +118,28 @@
 ort sys%0A
+import json%0A
  %0Atotal 
@@ -187,17 +187,16 @@
 ndex=%22*%22
-;
 %0Alimit=1
@@ -197,17 +197,16 @@
 imit=100
-;
 %0AoldestD
@@ -213,18 +213,20 @@
 ate=%22now
+-1d
 %22
-;
 %0Aearlies
@@ -239,13 +239,9 @@
 %22now
--1d%22;
+%22
 %0Adef
@@ -259,17 +259,16 @@
 message%22
-;
 %0Aquery=%22
@@ -269,17 +269,16 @@
 uery=%22*%22
-;
 %0Afor i i
@@ -320,17 +320,16 @@
 argv%5Bi%5D)
-;
 %0A   if (
@@ -393,33 +393,32 @@
 %5D).split(%22=%22)%5B1%5D
-;
 %0A   elif (  opt.
@@ -476,33 +476,32 @@
 %5D).split(%22=%22)%5B1%5D
-;
 %0A   elif (  opt.
@@ -565,33 +565,32 @@
 %5D).split(%22=%22)%5B1%5D
-;
 %0A   elif (  opt.
@@ -654,33 +654,32 @@
 %5D).split(%22=%22)%5B1%5D
-;
 %0A   elif (  opt.
@@ -747,25 +747,24 @@
 plit(%22=%22)%5B1%5D
-;
 %0A   elif (  
@@ -834,17 +834,16 @@
 (%22=%22)%5B1%5D
-;
 %0A   %0App 
@@ -875,16 +875,86 @@
 dent=4)%0A
+# to query an external server: Elasticsearch(%5B'http://1.2.3.4:9200'%5D)%0A
 es = Ela
@@ -996,16 +996,33 @@
  limit,%0A
+      %22from%22: 0,%0A
       %22q
@@ -1044,16 +1044,12 @@
    %22
-filtered
+bool
 %22 : 
@@ -1059,32 +1059,32 @@
            %22
-query
+must
 %22: 
+%5B
 %7B%0A          
@@ -1225,29 +1225,16 @@
        %7D
-%0A            
 %7D,%0A     
@@ -1244,40 +1244,15 @@
     
-%22filter%22 : %7B%0A             
       
+%7B
 %22ran
@@ -1442,32 +1442,85 @@
  %7D%0A            %7D
+%5D,%0A            %22must_not%22:%5B%5D,%0A            %22should%22:%5B%5D
 %0A        %7D%0A     
@@ -1545,17 +1545,16 @@
 nt(body)
-;
 %0Ares = e
@@ -1597,17 +1597,16 @@
 dy=body)
-;
 %0Aprint(%22
@@ -1644,17 +1644,16 @@
 type%5C%22%22)
-;
 %0A#pp.ppr
@@ -1660,17 +1660,16 @@
 int(res)
-;
 %0A#date_t
@@ -1772,89 +1772,8 @@
 '%5D:%0A
-   hit%5B%22_source%22%5D%5BdefaultField%5D = hit%5B%22_source%22%5D%5BdefaultField%5D.replace('%22',' ');%0A
    e
@@ -1820,9 +1820,8 @@
 mp'%5D
-;
 %0A   
@@ -1930,16 +1930,27 @@
 %22_raw%22%5D=
+json.dumps(
 hit%5B'_so
@@ -1969,16 +1969,34 @@
 ltField%5D
+).replace('%22',' ')
 %0A   prin

Update the code base for ES 2.x