Help with kibana partial string search


(Kingdom Joy) #1

Hello,

I have logs that look like these:
07 Aug 2014 20:59:15,903 [ERROR] some-id
this.is.a.package.ExceptionTranslator: ABCD FHGHIK EX:Failed to invoke

I use ELK stack. In Kibana I am trying to search for logs that contain
string "ABCD FHGHIK EX" but it returns no data, I've tried using regex
/ABCD FHGHIK EX*/ but it also returns no data. I also tried escaping
whitespace /ABCD\ FHGHIK\ EX*/ but it also returns nothing.

Could someone explain how to make this type of search work?

Thank you!

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/5021ff02-ac9b-4202-b8e3-486d381c8dd9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(Cristian Falcas) #2

Try like this:

."ABCD FHGHIK EX".

On Fri, Aug 8, 2014 at 7:39 PM, Kingdom Joy thekingdomofjoy@gmail.com
wrote:

Hello,

I have logs that look like these:
07 Aug 2014 20:59:15,903 [ERROR] some-id
this.is.a.package.ExceptionTranslator: ABCD FHGHIK EX:Failed to invoke

I use ELK stack. In Kibana I am trying to search for logs that contain
string "ABCD FHGHIK EX" but it returns no data, I've tried using regex
/ABCD FHGHIK EX*/ but it also returns no data. I also tried escaping
whitespace /ABCD\ FHGHIK\ EX*/ but it also returns nothing.

Could someone explain how to make this type of search work?

Thank you!

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/5021ff02-ac9b-4202-b8e3-486d381c8dd9%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/5021ff02-ac9b-4202-b8e3-486d381c8dd9%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAMo7R_eXju5%2B1eRifhB%2BB4TCNgxkfLSUucV558j1pO9rJ1hBqA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.


(Kingdom Joy) #3

Thank you for suggestion but it doesn't work for me ;(

On Friday, 8 August 2014 10:53:29 UTC-7, Cristian Falcas wrote:

Try like this:

."ABCD FHGHIK EX".

On Fri, Aug 8, 2014 at 7:39 PM, Kingdom Joy <theking...@gmail.com
<javascript:>> wrote:

Hello,

I have logs that look like these:
07 Aug 2014 20:59:15,903 [ERROR] some-id
this.is.a.package.ExceptionTranslator: ABCD FHGHIK EX:Failed to invoke

I use ELK stack. In Kibana I am trying to search for logs that contain
string "ABCD FHGHIK EX" but it returns no data, I've tried using regex
/ABCD FHGHIK EX*/ but it also returns no data. I also tried escaping
whitespace /ABCD\ FHGHIK\ EX*/ but it also returns nothing.

Could someone explain how to make this type of search work?

Thank you!

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/5021ff02-ac9b-4202-b8e3-486d381c8dd9%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/5021ff02-ac9b-4202-b8e3-486d381c8dd9%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/565f6562-89db-4581-907a-a402e5861df1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(system) #4