elasticsearch - Wildcard search in Kibana for string text in message field

link之家

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Learn more about Collectives

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

I have the following plain text string in the message field in Kibana

message: Request result. Request: amount=58289.540000, name=Raj, so on.....

In Kibana in Lucene search when I use message: "Request Result" then I get the correct match.

But I want to search using wildcard like message: "Request Resu*" . Is this possible without any changes to the logs or to Kibana index?

Edit:

I thought that "message" is a plain text log, when I search "amount=58289.540000, name=Raj" then I get the result but when I search for "amount=58289.540000, name=R" then I dont get any result. How does Kibana know that this is a partial value?

I guess message is not plain text? How can I know what is the type of the log that I am viewing in Kibana GUI?

What you're trying to achieve, might not be currently available, but you can try putting Request Resu in the query bar (without the "Message:" part and no double-quotes).


    Request Resu

(without quotes) will return every doc where the message field contains Request or Resu or both.


    "Request Resu"

(with quotes) will return every doc where the message field contains Request and Resu both in the same order.

You cannot use wildcards inside of phrases .

The search queries mentioned below (one word) would work as per the requirements:


    message:*request*resu*


    message:?request*


    message:?req*


    message:*?resul*

NB : Since Elasticsearch applies the analyzers on your queries, it might look like wildcards are working inside phrases if you place them at the beginning/end of words. — e.g. IN YOUR CASE: message: "Request Resu*" (with quotes) will still return both documents on analyzed data, but. that is not because your wildcard worked as expected, but it is because the analyzer stripped the asterisk when analyzing the query. That query wouldn't find the value "Request Resuxxxxx".

You might wanna go through this link for more details.

So wildcard is actually useless in this case because with or without wildcard works the same way for plain text search in double quotes? – firstpostcommenter Jan 4, 2021 at 7:00 I thought that


    message

field in the log is plain text but may be it is not. I have edited the question – firstpostcommenter Jan 5, 2021 at 17:21

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question . Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers .