Elasticsearch

Elasticsearch http://www.elasticsearch.org/ is a distributed full-text search engine based on Lucene. It provides a RESTful HTTP API as well as a binary API for indexing and searching documents. Elasticsearch offers unicast and multicast discovery of nodes in a cluster.

Ports used

Dissector status

Protocol type

Dissection

Notes

HTTP

Full

Passed to HTTP dissector

Discovery

Full

Binary

Partial

Actions, request/response type, request IDs, errors and packet length decoded.

Supported versions

In theory the dissector should work from versions of Elasticsearch >= 0.20.0RC1. This may change as the binary protocol gets more dissection work.

Example packet captures

Filtering

The filter elasticsearch will include Discovery, HTTP and Binary protocols.

Code reviews

To do

Elasticsearch (last edited 2014-10-30 10:41:34 by ryandoyle)