Include/Exclude Pattern syntax

[cisaksen]

I've been reading some post regarding include and exclude patterns and i'm still not sure what the correct syntax is.

Is there a single syntax to these pattern options or is it based on the field your searching for a pattern on? I've tried RegEx and the visual throws errors. Even tried
Lucene query format (http://www.lucenetutorial.com/lucene-query-syntax.html) - still get errors.

here is the error i keep getting: Error: [parsing_exception] Expected [START_OBJECT] under [size], but got a [VALUE_NUMBER] in [3], with { line=1 & col=427 }

[Brandon_Kobel]

@cisaksen Are you getting this error when using the Include/Exclude options highlighted below?

[cisaksen]

yes no matter what i put in it.

[Brandon_Kobel]

@cisaksen - If you're running version 5.2.0 or 5.2.1 of Elasticsearch, this is a known issue. The Include/Exclude syntax that Kibana uses was accidentally removed when it should have been deprecated. If you upgrade Elasticsearch to 5.2.2, this is resolved.

[cisaksen]

Ok so if it's been deprecated should I even bother to use it ? or is something else going to replace it ?

[Brandon_Kobel]

@cisaksen Feel free to keep using it, we'll be upgrading Kibana to use the new syntax with 6.0 so you won't have to worry about anything. It just requires you to use 5.2.2 of Elasticsearch for the time being.

[cisaksen]

Ok - I will keep trying it out. Question: What is the syntax that i should use ?

[Brandon_Kobel]

@cisaksen The Include/Exclude fields are used for the terms aggregation that is passed to Elasticsearch and it's the same as the Regular Expression Syntax

[cisaksen]

ok thanks