Hi, I'm wanting to filter out strings starting with a number of characters. I've been able to solve this using a DSL query. Let me provide the example first:
# Cleanup
DELETE discuss-338708
# Create an index
PUT discus-338708
{
"mappings": {
"properties": {
"ts": {"type": "date"},
"entityID": { "type": "keyword"}
}
}
}
# Add some data
POST discuss-338708/_bulk
{ "index": {}}
{ "ts": "2023-07-19T12:42:55+0200", "entityID": "1.1.225.0.5.0.0"}
{ "index": {}}
{ "ts": "2023-07-19T12:22:55+0200", "entityID": "2.10.225.1.7.1.0"}
{ "index": {}}
{ "ts": "2023-07-19T12:12:55+0200", "entityID": "0.0.0.0.0.0.0"}
{ "index": {}}
{ "ts": "2023-07-19T12:02:55+0200", "entityID": "1.1.225.28.25.0.0"}
{ "index": {}}
{ "ts": "2023-07-19T11:52:55+0200", "entityID": "2.10.225.1.7.1.0"}
{ "index": {}}
{ "ts": "2023-07-19T11:42:55+0200", "entityID": "5.2.225.0.1.0.0"}
{ "index": {}}
{ "ts": "2023-07-19T11:32:55+0200"}
{ "index": {}}
{ "ts": "2023-07-19T11:22:55+0200"}
I solve this by using the following DSL query, but I could only find the way to filter for a single starting prefix:
{
"query": {
"prefix": {
"entityType.keyword": {
"value": "1"
}
}
}
}
So, I'm wondering how I could do this in KQL, or as a runtime field. I am also wondering how I would be able to filter out , say, strings ["0", "2"]. I'm sorry if this is in the documentation but I was not be able to find a suitable page describing my questions.
Thanks.