Elasticsearch Help

Elastic Stack Elasticsearch
1

Hi
I use Elasticsearch a lot in my job but I'm having a hard time trying to search for Windows paths in my data.

For example, I want to search for: C:\Users\user\downloads

I tried every type of search but I can't seem to get it. I escaped it, spaces, I even tried regex but I'm still unable to search for that path.

I am trying to search in the webui under "Discover"

TIA!

2

Welcome!

There are few things to check:

3

Yes it is a keyword field and called "ParentPath".

Can I do ParentPath : "*Downloads*"

4

Yes with a path hierarchy tokenizer. This should be doable.
Also with the default analyzer with a text field, searching for Downloads should work. No need for *Downloads*.

5

Thank you.

This is not working: ParentPath : User\Downloads

6

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script is something anyone can copy and paste in Kibana dev console, click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

Have a look at the Elastic Stack and Solutions Help · Forums and Slack | Elastic page. It contains also lot of useful information on how to ask for help.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.