logstash-input-elasticsearch 4.20.4 → 4.21.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -0
- data/docs/index.asciidoc +24 -13
- data/lib/logstash/inputs/elasticsearch.rb +8 -2
- data/logstash-input-elasticsearch.gemspec +1 -1
- data/spec/inputs/elasticsearch_spec.rb +28 -0
- metadata +20 -20
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: bf89e42e7146cb59e938fed4a2a2d352bc72bf5c73c59d2a674be724c686a543
|
4
|
+
data.tar.gz: 9b0b0b80d4a3754dac6e5d4f2c179dbd1be2ee6d6ce6c2b1fc619c2369a808aa
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 87223b2b656aee8d27c9f0ea92151370f3eb46b1851040054f0fa74e99ab4882278b28c85d4f8290d211ef793ab3eab9141b9c3ab343bd80cc5b9b9e7f0ceb11
|
7
|
+
data.tar.gz: 10db333c4a67f69fb695bede43feb8f89692609afd74c40de3babf9b56580c18ea1d839865c66e9ec5ade759825309aecd84a2d269805583e8053b48bb563af9
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,9 @@
|
|
1
|
+
## 4.21.0
|
2
|
+
- Add support for custom headers [#217](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/217)
|
3
|
+
|
4
|
+
## 4.20.5
|
5
|
+
- Add `x-elastic-product-origin` header to Elasticsearch requests [#211](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/211)
|
6
|
+
|
1
7
|
## 4.20.4
|
2
8
|
- Fix issue where the `index` parameter was being ignored when using `response_type => aggregations` [#209](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/209)
|
3
9
|
|
data/docs/index.asciidoc
CHANGED
@@ -23,7 +23,7 @@ include::{include_path}/plugin_header.asciidoc[]
|
|
23
23
|
|
24
24
|
Read from an Elasticsearch cluster, based on search query results.
|
25
25
|
This is useful for replaying test logs, reindexing, etc.
|
26
|
-
You can periodically schedule ingestion using a cron syntax
|
26
|
+
You can periodically schedule ingestion using a cron syntax
|
27
27
|
(see `schedule` setting) or run the query one time to load
|
28
28
|
data into Logstash.
|
29
29
|
|
@@ -106,6 +106,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
|
|
106
106
|
| <<plugins-{type}s-{plugin}-cloud_auth>> |<<password,password>>|No
|
107
107
|
| <<plugins-{type}s-{plugin}-cloud_id>> |<<string,string>>|No
|
108
108
|
| <<plugins-{type}s-{plugin}-connect_timeout_seconds>> | <<number,number>>|No
|
109
|
+
| <<plugins-{type}s-{plugin}-custom_headers>> |<<hash,hash>>|No
|
109
110
|
| <<plugins-{type}s-{plugin}-docinfo>> |<<boolean,boolean>>|No
|
110
111
|
| <<plugins-{type}s-{plugin}-docinfo_fields>> |<<array,array>>|No
|
111
112
|
| <<plugins-{type}s-{plugin}-docinfo_target>> |<<string,string>>|No
|
@@ -199,8 +200,18 @@ For more info, check out the
|
|
199
200
|
The maximum amount of time, in seconds, to wait while establishing a connection to Elasticsearch.
|
200
201
|
Connect timeouts tend to occur when Elasticsearch or an intermediate proxy is overloaded with requests and has exhausted its connection pool.
|
201
202
|
|
203
|
+
[id="plugins-{type}s-{plugin}-custom_headers"]
|
204
|
+
===== `custom_headers`
|
205
|
+
|
206
|
+
* Value type is <<hash,hash>>
|
207
|
+
* Default value is empty
|
208
|
+
|
209
|
+
Pass a set of key value pairs as the headers sent in each request to an elasticsearch node.
|
210
|
+
The headers will be used for any kind of request.
|
211
|
+
These custom headers will override any headers previously set by the plugin such as the User Agent or Authorization headers.
|
212
|
+
|
202
213
|
[id="plugins-{type}s-{plugin}-docinfo"]
|
203
|
-
===== `docinfo`
|
214
|
+
===== `docinfo`
|
204
215
|
|
205
216
|
* Value type is <<boolean,boolean>>
|
206
217
|
* Default value is `false`
|
@@ -251,7 +262,7 @@ Example
|
|
251
262
|
|
252
263
|
|
253
264
|
[id="plugins-{type}s-{plugin}-docinfo_fields"]
|
254
|
-
===== `docinfo_fields`
|
265
|
+
===== `docinfo_fields`
|
255
266
|
|
256
267
|
* Value type is <<array,array>>
|
257
268
|
* Default value is `["_index", "_type", "_id"]`
|
@@ -262,7 +273,7 @@ option lists the metadata fields to save in the current event. See
|
|
262
273
|
more information.
|
263
274
|
|
264
275
|
[id="plugins-{type}s-{plugin}-docinfo_target"]
|
265
|
-
===== `docinfo_target`
|
276
|
+
===== `docinfo_target`
|
266
277
|
|
267
278
|
* Value type is <<string,string>>
|
268
279
|
* Default value depends on whether <<plugins-{type}s-{plugin}-ecs_compatibility>> is enabled:
|
@@ -286,7 +297,7 @@ this option names the field under which to store the metadata fields as subfield
|
|
286
297
|
Controls this plugin's compatibility with the {ecs-ref}[Elastic Common Schema (ECS)].
|
287
298
|
|
288
299
|
[id="plugins-{type}s-{plugin}-hosts"]
|
289
|
-
===== `hosts`
|
300
|
+
===== `hosts`
|
290
301
|
|
291
302
|
* Value type is <<array,array>>
|
292
303
|
* There is no default value for this setting.
|
@@ -296,18 +307,18 @@ can be either IP, HOST, IP:port, or HOST:port. The port defaults to
|
|
296
307
|
9200.
|
297
308
|
|
298
309
|
[id="plugins-{type}s-{plugin}-index"]
|
299
|
-
===== `index`
|
310
|
+
===== `index`
|
300
311
|
|
301
312
|
* Value type is <<string,string>>
|
302
313
|
* Default value is `"logstash-*"`
|
303
314
|
|
304
|
-
The index or alias to search.
|
315
|
+
The index or alias to search.
|
305
316
|
Check out {ref}/api-conventions.html#api-multi-index[Multi Indices
|
306
317
|
documentation] in the Elasticsearch documentation for info on
|
307
318
|
referencing multiple indices.
|
308
319
|
|
309
320
|
[id="plugins-{type}s-{plugin}-password"]
|
310
|
-
===== `password`
|
321
|
+
===== `password`
|
311
322
|
|
312
323
|
* Value type is <<password,password>>
|
313
324
|
* There is no default value for this setting.
|
@@ -327,7 +338,7 @@ An empty string is treated as if proxy was not set, this is useful when using
|
|
327
338
|
environment variables e.g. `proxy => '${LS_PROXY:}'`.
|
328
339
|
|
329
340
|
[id="plugins-{type}s-{plugin}-query"]
|
330
|
-
===== `query`
|
341
|
+
===== `query`
|
331
342
|
|
332
343
|
* Value type is <<string,string>>
|
333
344
|
* Default value is `'{ "sort": [ "_doc" ] }'`
|
@@ -375,7 +386,7 @@ The default is 0 (no retry). This value should be equal to or greater than zero.
|
|
375
386
|
NOTE: Partial failures - such as errors in a subset of all slices - can result in the entire query being retried, which can lead to duplication of data. Avoiding this would require Logstash to store the entire result set of a query in memory which is often not possible.
|
376
387
|
|
377
388
|
[id="plugins-{type}s-{plugin}-schedule"]
|
378
|
-
===== `schedule`
|
389
|
+
===== `schedule`
|
379
390
|
|
380
391
|
* Value type is <<string,string>>
|
381
392
|
* There is no default value for this setting.
|
@@ -387,7 +398,7 @@ There is no schedule by default. If no schedule is given, then the statement is
|
|
387
398
|
exactly once.
|
388
399
|
|
389
400
|
[id="plugins-{type}s-{plugin}-scroll"]
|
390
|
-
===== `scroll`
|
401
|
+
===== `scroll`
|
391
402
|
|
392
403
|
* Value type is <<string,string>>
|
393
404
|
* Default value is `"1m"`
|
@@ -410,7 +421,7 @@ The query requires at least one `sort` field, as described in the <<plugins-{typ
|
|
410
421
|
`scroll` uses {ref}/paginate-search-results.html#scroll-search-results[scroll] API to search, which is no longer recommended.
|
411
422
|
|
412
423
|
[id="plugins-{type}s-{plugin}-size"]
|
413
|
-
===== `size`
|
424
|
+
===== `size`
|
414
425
|
|
415
426
|
* Value type is <<number,number>>
|
416
427
|
* Default value is `1000`
|
@@ -598,7 +609,7 @@ It is also possible to target an entry in the event's metadata, which will be av
|
|
598
609
|
|
599
610
|
|
600
611
|
[id="plugins-{type}s-{plugin}-user"]
|
601
|
-
===== `user`
|
612
|
+
===== `user`
|
602
613
|
|
603
614
|
* Value type is <<string,string>>
|
604
615
|
* There is no default value for this setting.
|
@@ -24,9 +24,9 @@ require_relative "elasticsearch/patches/_elasticsearch_transport_connections_sel
|
|
24
24
|
# called `http.content_type.required`. If this option is set to `true`, and you
|
25
25
|
# are using Logstash 2.4 through 5.2, you need to update the Elasticsearch input
|
26
26
|
# plugin to version 4.0.2 or higher.
|
27
|
-
#
|
27
|
+
#
|
28
28
|
# ================================================================================
|
29
|
-
#
|
29
|
+
#
|
30
30
|
# Read from an Elasticsearch cluster, based on search query results.
|
31
31
|
# This is useful for replaying test logs, reindexing, etc.
|
32
32
|
# It also supports periodically scheduling lookup enrichments
|
@@ -166,6 +166,9 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
|
|
166
166
|
# http://www.elasticsearch.org/guide/en/elasticsearch/guide/current/_document_metadata.html
|
167
167
|
config :docinfo_fields, :validate => :array, :default => ['_index', '_type', '_id']
|
168
168
|
|
169
|
+
# Custom headers for Elasticsearch requests
|
170
|
+
config :custom_headers, :validate => :hash, :default => {}
|
171
|
+
|
169
172
|
# Basic Auth - username
|
170
173
|
config :user, :validate => :string
|
171
174
|
|
@@ -271,6 +274,7 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
|
|
271
274
|
|
272
275
|
BUILD_FLAVOR_SERVERLESS = 'serverless'.freeze
|
273
276
|
DEFAULT_EAV_HEADER = { "Elastic-Api-Version" => "2023-10-31" }.freeze
|
277
|
+
INTERNAL_ORIGIN_HEADER = { 'x-elastic-product-origin' => 'logstash-input-elasticsearch'}.freeze
|
274
278
|
|
275
279
|
def initialize(params={})
|
276
280
|
super(params)
|
@@ -300,9 +304,11 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
|
|
300
304
|
fill_user_password_from_cloud_auth
|
301
305
|
|
302
306
|
transport_options = {:headers => {}}
|
307
|
+
transport_options[:headers].merge!(INTERNAL_ORIGIN_HEADER)
|
303
308
|
transport_options[:headers].merge!(setup_basic_auth(user, password))
|
304
309
|
transport_options[:headers].merge!(setup_api_key(api_key))
|
305
310
|
transport_options[:headers].merge!({'user-agent' => prepare_user_agent()})
|
311
|
+
transport_options[:headers].merge!(@custom_headers) unless @custom_headers.empty?
|
306
312
|
transport_options[:request_timeout] = @request_timeout_seconds unless @request_timeout_seconds.nil?
|
307
313
|
transport_options[:connect_timeout] = @connect_timeout_seconds unless @connect_timeout_seconds.nil?
|
308
314
|
transport_options[:socket_timeout] = @socket_timeout_seconds unless @socket_timeout_seconds.nil?
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-input-elasticsearch'
|
4
|
-
s.version = '4.
|
4
|
+
s.version = '4.21.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Reads query results from an Elasticsearch cluster"
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
@@ -50,6 +50,12 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
|
|
50
50
|
client = plugin.send(:client)
|
51
51
|
expect( extract_transport(client).options[:transport_options][:headers] ).not_to match hash_including("Elastic-Api-Version" => "2023-10-31")
|
52
52
|
end
|
53
|
+
|
54
|
+
it "sets an x-elastic-product-origin header identifying this as an internal plugin request" do
|
55
|
+
plugin.register
|
56
|
+
client = plugin.send(:client)
|
57
|
+
expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including("x-elastic-product-origin"=>"logstash-input-elasticsearch")
|
58
|
+
end
|
53
59
|
end
|
54
60
|
|
55
61
|
context "against not authentic Elasticsearch" do
|
@@ -90,6 +96,28 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
|
|
90
96
|
client = plugin.send(:client)
|
91
97
|
expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including("Elastic-Api-Version" => "2023-10-31")
|
92
98
|
end
|
99
|
+
|
100
|
+
it "sets an x-elastic-product-origin header identifying this as an internal plugin request" do
|
101
|
+
plugin.register
|
102
|
+
client = plugin.send(:client)
|
103
|
+
expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including("x-elastic-product-origin"=>"logstash-input-elasticsearch")
|
104
|
+
end
|
105
|
+
end
|
106
|
+
|
107
|
+
context "with custom headers" do
|
108
|
+
let(:config) do
|
109
|
+
{
|
110
|
+
"schedule" => "* * * * * UTC",
|
111
|
+
"custom_headers" => { "Custom-Header-1" => "Custom Value 1", "Custom-Header-2" => "Custom Value 2" }
|
112
|
+
}
|
113
|
+
end
|
114
|
+
|
115
|
+
|
116
|
+
it "sets custom headers" do
|
117
|
+
plugin.register
|
118
|
+
client = plugin.send(:client)
|
119
|
+
expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including(config["custom_headers"])
|
120
|
+
end
|
93
121
|
end
|
94
122
|
end
|
95
123
|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-input-elasticsearch
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.
|
4
|
+
version: 4.21.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-
|
11
|
+
date: 2024-12-18 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
@@ -20,8 +20,8 @@ dependencies:
|
|
20
20
|
- !ruby/object:Gem::Version
|
21
21
|
version: '2.99'
|
22
22
|
name: logstash-core-plugin-api
|
23
|
-
prerelease: false
|
24
23
|
type: :runtime
|
24
|
+
prerelease: false
|
25
25
|
version_requirements: !ruby/object:Gem::Requirement
|
26
26
|
requirements:
|
27
27
|
- - ">="
|
@@ -37,8 +37,8 @@ dependencies:
|
|
37
37
|
- !ruby/object:Gem::Version
|
38
38
|
version: '1.3'
|
39
39
|
name: logstash-mixin-ecs_compatibility_support
|
40
|
-
prerelease: false
|
41
40
|
type: :runtime
|
41
|
+
prerelease: false
|
42
42
|
version_requirements: !ruby/object:Gem::Requirement
|
43
43
|
requirements:
|
44
44
|
- - "~>"
|
@@ -51,8 +51,8 @@ dependencies:
|
|
51
51
|
- !ruby/object:Gem::Version
|
52
52
|
version: '1.0'
|
53
53
|
name: logstash-mixin-event_support
|
54
|
-
prerelease: false
|
55
54
|
type: :runtime
|
55
|
+
prerelease: false
|
56
56
|
version_requirements: !ruby/object:Gem::Requirement
|
57
57
|
requirements:
|
58
58
|
- - "~>"
|
@@ -65,8 +65,8 @@ dependencies:
|
|
65
65
|
- !ruby/object:Gem::Version
|
66
66
|
version: '1.0'
|
67
67
|
name: logstash-mixin-validator_support
|
68
|
-
prerelease: false
|
69
68
|
type: :runtime
|
69
|
+
prerelease: false
|
70
70
|
version_requirements: !ruby/object:Gem::Requirement
|
71
71
|
requirements:
|
72
72
|
- - "~>"
|
@@ -79,8 +79,8 @@ dependencies:
|
|
79
79
|
- !ruby/object:Gem::Version
|
80
80
|
version: '1.0'
|
81
81
|
name: logstash-mixin-scheduler
|
82
|
-
prerelease: false
|
83
82
|
type: :runtime
|
83
|
+
prerelease: false
|
84
84
|
version_requirements: !ruby/object:Gem::Requirement
|
85
85
|
requirements:
|
86
86
|
- - "~>"
|
@@ -93,8 +93,8 @@ dependencies:
|
|
93
93
|
- !ruby/object:Gem::Version
|
94
94
|
version: 7.17.9
|
95
95
|
name: elasticsearch
|
96
|
-
prerelease: false
|
97
96
|
type: :runtime
|
97
|
+
prerelease: false
|
98
98
|
version_requirements: !ruby/object:Gem::Requirement
|
99
99
|
requirements:
|
100
100
|
- - ">="
|
@@ -107,8 +107,8 @@ dependencies:
|
|
107
107
|
- !ruby/object:Gem::Version
|
108
108
|
version: '1.0'
|
109
109
|
name: logstash-mixin-ca_trusted_fingerprint_support
|
110
|
-
prerelease: false
|
111
110
|
type: :runtime
|
111
|
+
prerelease: false
|
112
112
|
version_requirements: !ruby/object:Gem::Requirement
|
113
113
|
requirements:
|
114
114
|
- - "~>"
|
@@ -121,8 +121,8 @@ dependencies:
|
|
121
121
|
- !ruby/object:Gem::Version
|
122
122
|
version: '1.0'
|
123
123
|
name: logstash-mixin-normalize_config_support
|
124
|
-
prerelease: false
|
125
124
|
type: :runtime
|
125
|
+
prerelease: false
|
126
126
|
version_requirements: !ruby/object:Gem::Requirement
|
127
127
|
requirements:
|
128
128
|
- - "~>"
|
@@ -135,8 +135,8 @@ dependencies:
|
|
135
135
|
- !ruby/object:Gem::Version
|
136
136
|
version: '0'
|
137
137
|
name: tzinfo
|
138
|
-
prerelease: false
|
139
138
|
type: :runtime
|
139
|
+
prerelease: false
|
140
140
|
version_requirements: !ruby/object:Gem::Requirement
|
141
141
|
requirements:
|
142
142
|
- - ">="
|
@@ -149,8 +149,8 @@ dependencies:
|
|
149
149
|
- !ruby/object:Gem::Version
|
150
150
|
version: '0'
|
151
151
|
name: tzinfo-data
|
152
|
-
prerelease: false
|
153
152
|
type: :runtime
|
153
|
+
prerelease: false
|
154
154
|
version_requirements: !ruby/object:Gem::Requirement
|
155
155
|
requirements:
|
156
156
|
- - ">="
|
@@ -163,8 +163,8 @@ dependencies:
|
|
163
163
|
- !ruby/object:Gem::Version
|
164
164
|
version: 0.7.1
|
165
165
|
name: manticore
|
166
|
-
prerelease: false
|
167
166
|
type: :runtime
|
167
|
+
prerelease: false
|
168
168
|
version_requirements: !ruby/object:Gem::Requirement
|
169
169
|
requirements:
|
170
170
|
- - ">="
|
@@ -177,8 +177,8 @@ dependencies:
|
|
177
177
|
- !ruby/object:Gem::Version
|
178
178
|
version: '0'
|
179
179
|
name: logstash-codec-plain
|
180
|
-
prerelease: false
|
181
180
|
type: :development
|
181
|
+
prerelease: false
|
182
182
|
version_requirements: !ruby/object:Gem::Requirement
|
183
183
|
requirements:
|
184
184
|
- - ">="
|
@@ -191,8 +191,8 @@ dependencies:
|
|
191
191
|
- !ruby/object:Gem::Version
|
192
192
|
version: '0'
|
193
193
|
name: logstash-devutils
|
194
|
-
prerelease: false
|
195
194
|
type: :development
|
195
|
+
prerelease: false
|
196
196
|
version_requirements: !ruby/object:Gem::Requirement
|
197
197
|
requirements:
|
198
198
|
- - ">="
|
@@ -205,8 +205,8 @@ dependencies:
|
|
205
205
|
- !ruby/object:Gem::Version
|
206
206
|
version: '0'
|
207
207
|
name: timecop
|
208
|
-
prerelease: false
|
209
208
|
type: :development
|
209
|
+
prerelease: false
|
210
210
|
version_requirements: !ruby/object:Gem::Requirement
|
211
211
|
requirements:
|
212
212
|
- - ">="
|
@@ -219,8 +219,8 @@ dependencies:
|
|
219
219
|
- !ruby/object:Gem::Version
|
220
220
|
version: '0.6'
|
221
221
|
name: cabin
|
222
|
-
prerelease: false
|
223
222
|
type: :development
|
223
|
+
prerelease: false
|
224
224
|
version_requirements: !ruby/object:Gem::Requirement
|
225
225
|
requirements:
|
226
226
|
- - "~>"
|
@@ -233,8 +233,8 @@ dependencies:
|
|
233
233
|
- !ruby/object:Gem::Version
|
234
234
|
version: '0'
|
235
235
|
name: webrick
|
236
|
-
prerelease: false
|
237
236
|
type: :development
|
237
|
+
prerelease: false
|
238
238
|
version_requirements: !ruby/object:Gem::Requirement
|
239
239
|
requirements:
|
240
240
|
- - ">="
|
@@ -247,8 +247,8 @@ dependencies:
|
|
247
247
|
- !ruby/object:Gem::Version
|
248
248
|
version: 3.0.9
|
249
249
|
name: rufus-scheduler
|
250
|
-
prerelease: false
|
251
250
|
type: :development
|
251
|
+
prerelease: false
|
252
252
|
version_requirements: !ruby/object:Gem::Requirement
|
253
253
|
requirements:
|
254
254
|
- - "~>"
|
@@ -307,7 +307,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
307
307
|
- !ruby/object:Gem::Version
|
308
308
|
version: '0'
|
309
309
|
requirements: []
|
310
|
-
rubygems_version: 3.
|
310
|
+
rubygems_version: 3.3.26
|
311
311
|
signing_key:
|
312
312
|
specification_version: 4
|
313
313
|
summary: Reads query results from an Elasticsearch cluster
|