[00:48:25] FIRING: SystemdUnitFailed: curator_actions_cluster_wide.service on logstash2026:9100 - https://wikitech.wikimedia.org/wiki/Monitoring/check_systemd_state - https://grafana.wikimedia.org/d/g-AaZRFWk/systemd-status - https://alerts.wikimedia.org/?q=alertname%3DSystemdUnitFailed [04:48:40] FIRING: SystemdUnitFailed: curator_actions_cluster_wide.service on logstash2026:9100 - https://wikitech.wikimedia.org/wiki/Monitoring/check_systemd_state - https://grafana.wikimedia.org/d/g-AaZRFWk/systemd-status - https://alerts.wikimedia.org/?q=alertname%3DSystemdUnitFailed [08:48:40] FIRING: SystemdUnitFailed: curator_actions_cluster_wide.service on logstash2026:9100 - https://wikitech.wikimedia.org/wiki/Monitoring/check_systemd_state - https://grafana.wikimedia.org/d/g-AaZRFWk/systemd-status - https://alerts.wikimedia.org/?q=alertname%3DSystemdUnitFailed [12:48:40] FIRING: SystemdUnitFailed: curator_actions_cluster_wide.service on logstash2026:9100 - https://wikitech.wikimedia.org/wiki/Monitoring/check_systemd_state - https://grafana.wikimedia.org/d/g-AaZRFWk/systemd-status - https://alerts.wikimedia.org/?q=alertname%3DSystemdUnitFailed [16:48:40] FIRING: SystemdUnitFailed: curator_actions_cluster_wide.service on logstash2026:9100 - https://wikitech.wikimedia.org/wiki/Monitoring/check_systemd_state - https://grafana.wikimedia.org/d/g-AaZRFWk/systemd-status - https://alerts.wikimedia.org/?q=alertname%3DSystemdUnitFailed [16:53:25] RESOLVED: SystemdUnitFailed: curator_actions_cluster_wide.service on logstash2026:9100 - https://wikitech.wikimedia.org/wiki/Monitoring/check_systemd_state - https://grafana.wikimedia.org/d/g-AaZRFWk/systemd-status - https://alerts.wikimedia.org/?q=alertname%3DSystemdUnitFailed [20:01:43] Hello! I recently created this Phab task: https://phabricator.wikimedia.org/T372445 requesting 'access' to the LogStash server; however, it seems perhaps the syntax of my request was incorrect. I updated the ticket with what I get when I use the provided URL (rather than the localhost:9200), which still blocks me from proceeding with querying in [20:01:44] there. Could anyone provide some insight? [20:03:34] TLDR, this is the doc I'm using: https://wikitech.wikimedia.org/wiki/Logstash#Extract_data_from_Logstash_(OpenSearch)_with_curl_and_jq [20:03:34] The request I'm sending in (from my deployment server `ssh deployment.eqiad.wmnet`): [20:03:35] curl -XGET 'https://logs-api.svc.eqiad.wmnet/_msearch?pretty&size=10000' -d ' [20:03:35] { [20:03:36] "query": { [20:03:36] "query_string" : { [20:03:37] "query" : "facility:19,local3 AND host:csw2-esams AND @timestamp:[2019-08-04T03:00 TO 2019-08-04T03:15] NOT program:mgd" [20:03:37] } [20:03:38] }, [20:03:38] "sort": ["@timestamp"] [20:03:39] } ' [20:03:39] and what I get back: [20:03:40] [20:03:40] [20:03:41] 401 Unauthorized [20:03:41] [20:03:42]

Unauthorized

[20:03:42]

This server could not verify that you [20:04:29] I'd love to know what others get from that request... [20:04:30] TY in advance~!