I have messages which contain computer name under Windows domain. The format will be domain\computername. However, the message ends up domain\\computername in elasticsearch indice. When I do a search, I need to put domain\\\\computername in my query. Is it the expected behavior?

A single backslash becomes double backslash

Nww_Pot_Fung_Nng (Nww Pot Fung Nng) October 6, 2018, 1:24am 5

Right. It's the JSON serialization. Thanks!

Topic		Replies	Views
Backslashes in the query string JSONs not supported? Logstash	1	1530	January 19, 2017
Escaped '\' not respected? Elasticsearch	1	954	July 6, 2017
Query returning wrong search result Elasticsearch	2	650	July 6, 2017
Logstash gsub: how to replace with backslash? Logstash	1	1564	July 6, 2017
ES JsonParseException Elasticsearch	4	1327	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

A single backslash becomes double backslash

Related topics