How to filter a list of word with kibana

Elastic Stack Kibana
1

I tried to fetch some word using regexp in the filter but does not work:

{
  "query": {
    "regexp": {
      "message": {
      "value": "*.word1.word2.word3.*"
      }
    }
  }
}

I want to fetch messages that contains this bloc "word1.word2.word3". I don't know if I wrote something wrong or kibana does not accept this format.
How can I fix it?

2

If you want to find documents containing a certain substring, the wildcard query is probably the best choice: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html

Just switch regexp with wildcard and you should be good to go. However it will match everything containing .word1.word2.word3. (note the leading and trailing dots)

1 Like
3

Thanks for your answer, I'll try it.

4

I tried it but does not work, I have to mention the whole phrase to get the result, otherwise it is not able to filter the lines where the message contains the block of words I use to filter.

5

Can you share the mapping of your index and the filter you are testing with right now?

7

the message I got in kibana looks like that:

kibana
kibana1127×58 5.32 KB

and I'm lookig for messages containing "PSEGP.PSETP"

8

Can you please copy-paste the filter JSON you are using which should work but doesn't?

9 
{
  "query": {
    "wildcard": {
      "message": {
        "value": "*.PSEGP.PSETP.*"
      }
    }
  }
}
10

There is no . in front of "PSEGP" in your example - try

{
  "query": {
    "wildcard": {
      "message": {
        "value": "*PSEGP.PSETP.*"
      }
    }
  }
}
12

even like that does not work :confused:

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.