Dev Tools search with a "/" works, but in a query doesn't

Elastic Stack Kibana
1

Hi

Relatively new to Kibana and queries. I have a string in process.cwd along the lines of

/PTC/merge/code/CodeDrop_2017_12_18/AST-expanded/iCNS-AST/abc.txt

I'm trying to find all the entries that have

/PTC/ at the beginning then any project name (merge above) then /code/

Don't mind getting a few false positives.

In Kibana Dev Tools the following appears to work fine.

{
  "query": {
    "query_string": {
      "fields": [
        "process.cwd.keyword"
      ],
      "query": "\\/PTC\\/*\\/code\\/*",
      "analyzer": "keyword",
      "analyze_wildcard": true
    }
  }
}

I've tried to convert this into a query and so in the

kibanaSavedObjectMeta.searchSourceJSON field I have

{
  "index": "1cf03af0-037a-11e9-beef-5f4114182e77",
  "highlightAll": true,
  "version": true,
  "query": {
    "query_string": {
      "fields": [
        "process.cwd.keyword"
      ],
      "query": "\\/PTC\\/*\\/code\\/*",
      "analyzer": "keyword",
      "analyze_wildcard": true
    },
    "language": "lucene"
  },
  "filter": []
}

columns is set to "_source"

and on running this it just seems to find everything.

Guessing it might be to do with Lucene, but cannot find what else it might be set to.

On the query line in discover

process.cwd:(\/PTC\/ AND \/code\/) finds nothing

process.cwd:(/PTC/ AND /code/) Ignores the /'s and just finds those with both in wherever they are.

Any help gratefully received. N

2

Hi, if anyone in the community has anything I can try or has an answer, I'd appreciate it. Very stuck without it. Thanks, N

3

Can you try something like this:
process.cwd:/PTC/* and process.cwd:/code/ ?

4

Hi Marius

That is a little weird. Gives me some hits that do not have that information in, but then highlights some that I get with the following:

process.cwd:(/PTC/ AND /code/)

Basically, lots of false positives.

Thanks for trying!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.