How to filter in message this value "${date:"

[Roccof97 (Rocco)]

Hi,

is it possible to search for this string ${date: including the symbol '${:' in the message field?
to date I have not succeeded .

I have tried this:
message:"${date:"

but excludes ${:

who can help me?

Thanks!

[aaron-nimocks]

It looks like it works for me. The only part that doesn't is the highlighting doesn't seem to cover special characters but the filtering works.

[Roccof97 (Rocco)]

Hi,

yes but this makes my search dirty because it also finds the values ​​with only "date" and that's not good...
for example:

[aaron-nimocks]

I tested with a few more records and I see what you mean. I couldn't find a way to filter it using KQL.

If it's possible I would transform the data coming in if it's a hard requirement to match that phrase.

[Roccof97 (Rocco)]

Hi,

unfortunately I don't know Lucene well, can you tell me if you can also filter special characters with that?

Thanks

[aaron-nimocks]

Are you searching on message as a text or keyword field?

As a keyword message.keyword: "${date:" doesn't return records with date in it.

But message: "${date:" does.