How to filter in message this value "${date:"


is it possible to search for this string ${date: including the symbol '${:' in the message field?
to date I have not succeeded .

I have tried this:

but excludes ${:

who can help me?


It looks like it works for me. The only part that doesn't is the highlighting doesn't seem to cover special characters but the filtering works.


yes but this makes my search dirty because it also finds the values ​​with only "date" and that's not good...
for example:


I tested with a few more records and I see what you mean. I couldn't find a way to filter it using KQL.

If it's possible I would transform the data coming in if it's a hard requirement to match that phrase.

1 Like


unfortunately I don't know Lucene well, can you tell me if you can also filter special characters with that?


Are you searching on message as a text or keyword field?

As a keyword message.keyword: "${date:" doesn't return records with date in it.

But message: "${date:" does.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.