Kibana and unknown JSON

Elastic Stack Kibana
1

Okay - first time trying to play with kibana after weeks of trying to perfect mappings etc in ES and I am banging my head on the wall already :slight_smile:

I have data in two fields, "meta" (contains known data eg meta.hashvalue etc) and data which contains unknown data from different sources of which I have no idea of what fields will be in there and a hash value (data.hash and data.content). The content could be string or a JSON object and have between 1 and 100 fields (probably using the wrong name with fields - sorry!).

So, I can get kibana to query on the meta.keyword field but when I want to query something in the data, I want to try and use a wildcard along the lines of ["data.content.*"] but I am getting nothing back.

Is it possible to search using kibana and a the ["data.content.*"] type query?

Thanks!

2

You will have to make sure that the mapping for that field is type text, which is not analyized and fullports full-text searching.

3

Thanks for that - I set it to text before but didn't specify 'not analyzed' etc
Well, thats this mornings work then!

Thanks again

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.