Can't seem to search for a period in the message field

Elastic Stack Kibana
1

Hi everyone, I'm trying to do a really basic search in Kibana 4.0.1 but I'm having a lot of difficulty for some reason. Basically we want to search for ".prod" in the message field. The period is important, but Kibana seems to be ignoring it, returning everything that matches prod, even stuff like /PROD/whatever, which we don't want.

I've tried to escape the period with "", but there's no difference. Am I doing something wrong? Here's our filter:

"404" AND (".prod" OR ".cat")

It doesn't work on .prod or .cat.

2

This is likely because of the way that elasticsearch is analyzing your field values and not something that Kibana can control. Checkout this section of the Elasticsearch Definitive Guide for more information about analysis.