How to search a value by special character

Elastic Stack Kibana
1

Hi there,

so i have a field named uri_api and some of them have a value like this:
/scrt/kpi/v3/code/shean%20jeremy%20patok

i want to search other value like that in uri_api field. how can i achieve it? i already try it like this but it doesn't return any result:
uri_api : *%20*

then i try make a query like this and it give me the result :
uri_api : *20*

so my question is why i can't use special character to search some value? based on this documentation, it says the characters that must be escaped just this
image

so why my query using % didn't work?

Thanks

2

Hello @yuswanul,

Yes, *%20* should work,

Is there any error message? If you don't see any error messages, I suggest you try copying and pasting this full uri_api value for testing purposes. As it contains % it shouldn't work without escaping the character as well.

Additionally, please ensure that the time range is correct. You can perform a test using uri_api: * and check if the documents containing %20 are included.

Hope this helps!

3

The full uri_api value is same with i wrote before. And for the time range i'm sure there's no problem there but for error full message maybe i can send you later.

But for sure the value of uri_api is exactly same with i mention before. So you can test it locally. Thanks

4

What version of Elastic are you using? I would appreciate it if you could share the error message with me. This will help me better understand the context in which the error occurred.

5

I'm using v7.17. I can't share the error message right now cause i'm not on my laptop. I'll send you later

Pada tanggal Sel, 30 Mei 2023 02.55, Priscilla Parodi via Discuss the Elastic Stack <notifications@elastic.discoursemail.com> menulis:

6

i've tried using *%20* and it's doesn't return any error or result. but when i try to using *\%20* it give me this error
image

the only one query that give me the result is this:
20*

the % didn't included in search result
image

7

You're right, I tested it running Elastic 8.7, and it worked. However, now I tested it running on 7.17 and it didn't work.

% is not listed as a character to escape in the documentation, for both versions.

So, there might be some other reason for this issue. Would you mind opening an issue in the Kibana repository and mention this post?

8

sure, i can do that. but for now, i have another question.

how if i want to search a value that has a space inside it in 7.17?

image
image836Ă—453 43.8 KB

the data that has + between N and 7hWw are still included in search results.

i already tried to search like this and it's match with one data

image
image788Ă—303 22.5 KB

but why can't i use the same way to search the data that has whitespace?
do you think it's possible to include whitespace as a search?

thanks

9

To include whitespace as part of the query you can add the keyword value surrounded by double quotes.

For example, considering the message values:

Sean 20

Sean+20

And the query:

message.keyword : "Sean 20"

This should match Sean 20 but not Sean+20.

10

But if i using keyword, it means i need a exact value of the field right? How about if i want to search initial value that contain a whitespace?

Thanks

Pada tanggal Kam, 1 Jun 2023 07.01, Priscilla Parodi via Discuss the Elastic Stack <notifications@elastic.discoursemail.com> menulis:

11

What is your use case and why did you choose KQL?

If your goal is to be able to fetch data trough the Kibana Discover query bar, you can add a filter “+ Add Filter” and click “Edit as Query DSL” and then for something similar to what you want I would use a query_string query and save the filter.

Example:

IMG_1317
IMG_13171170Ă—905 70.2 KB

You can use * and whitespace, so it works for both use cases. Considering the context, in my opinion, it seems to be a good option.

12

Note: This is just an example in fact you can add the Query DSL that makes more sense, considering the use case. Full text queries.

13

so i had a field that have these types of value. note that the value is actually pretty long. these are just the snippets and the name of the field is requestPayload

  1. "hho/uFChjOENdwrbN 7hWw=="
  2. "hho/uFChjOENdwrbN+7hWw=="

i want to search requestPayload field that has value like #1. but it seems if i use query like requestPayload.keyword : *hho/uFChjOENdwrbN 7hWw==* it doesn't give me the result. it keeps give me the result of type #2 which has + on it, not space

14

Are you adding a Query DSL filter like I suggested?

15

i just expain my problem. i forgot to mention your question, sorry. let me try your suggestion first. thanks

16

image

i got this exception after i create the filter. do i need to escape the "/" character? but i already try it too and this exception still appear

i think the regex will give me the result. i'll try it

17

this is the filter
image
image

and this is the value of the field
image

finally it's work, thank you so much @Priscilla_Parodi

1 Like
18

Awesome! You're welcome!

19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.