Filtering in Kibana maybe query dsl?

Elastic Stack Kibana
1

Hello,

I create visualize in Kibana, based on 2 terms (Name_Pass and Message).

I search how to apply a specific filter on message_field (maybe with query dsl) :

If my message_field contains either the word "pass" or "pass" or "PASS"

=> To only keep the results that match

Message Field contains for example :

You a selected Pass Bolk
You have selected Option Risk
You have selected block brgz
You have seelct PASS CHIZO1

I want just the first and the last (because it contains word [P-p A-a S-s S-s]

2

Is message_field analyzed? Could you provide the mapping for it?

It should just be a matter of doing something like message_field:pass if it is analyzed.

3

I don't know, i don't think here ma mapping in elasticsearch :

"mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "strings_as_keywords": {
            "match_mapping_type": "string",
            "mapping": {
              "type": "keyword"
            }
          }
        }
      ],
      "_all": {
        "enabled": false
      },
4

Did you try searching for message_field:pass in the search bar?

5

Doesn't work. I try :

MESSAGE_TEXT:pass
MESSAGE_TEXT:Pass
message_field:pass
message_field:Pass

I disable the _all field and i delete message field in logstash it's a problem ?

6

Can you share your logstash config?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.