With Elasticsearch package I was able to get this output.
res = es.search(index="*:*-logs-ndb-*", body=body, size=1)
output=res['hits']['hits']
output
[{'_type': '_doc',
'_source': {'Id': '10032',
'log_format': 'plain',
'consumer_time': '2021-06-09T08:55:58.115',
'type': 'application',
'message': 'Created {\n "Id": "10032",\n "category": {\n "type": "Scheduled"\n },\n "api": false,\n "settings": {},\n "LogicInfo": {\n "isReq": false\n }\n}',
'index_pattern': 'main'}}]
I'm trying to parse "message" part so I can come up with a flat table that came from {.. } after 'Created (e.g. "Id", "category"... as column.)
Can anyone shed light on this? I tried res['hits']['hits']['message'] or res['hits']['hits'][0] just to start with but no luck so far.
Sorry if this is very newbie question but I've given up after 3 days' struggle.. -(