Finding inaccurate data entry


(Humornoy) #1

I can not understand how to use a type filter like LIKE in SQL?
I have this filed:


And try to find all documents, where Acronym LIKE "%CDeviceBufferManager::UpdateBuffer_Locked%", but i have no result. What syntax should i use?


(Brandon Kobel) #2

Hey @Humornoy, using the "query bar" at the top of Discover, you can use something similar to the following: Acronym:"*CDeviceBufferManager::UpdateBuffer_Locked*".


(Humornoy) #3

Doesnt work


(Brandon Kobel) #4

Would you mind confirming whether the Acronym field is a keyword or a text field? If you go to Management -> Index Patterns and then locate your field, if you see it being denoted as "aggregatable" then it's a "keyword" field (which is unanalyzed) and if you see it as not being aggregatable, then it's a "text" field.

Elasticsearch handles text and keyword fields differently, and this relates towards the different ways that you can query them.


(Humornoy) #5


It's aggregatable


(Brandon Kobel) #6

In that case, try Acronym:*CDeviceBufferManager::UpdateBuffer_Locked* (without the quotes)


(Humornoy) #7


Failed to parce query

P.S. thank you for help


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.