I'm using Kibana 4 with ElasticSearch 1.4.4 to store logs pushed by Logstash. I have a 'hostname' field which is not_analyzed and can't find how to query with a regex on this field.
Field content is a hostname with content like
machine.my-domain.tld machine2.my-domain.tld my1-machine2.my3-domain.tld
I want to search on the first part of this field, because in some events the hostname is short on other is FQDN. For example i want all my1-machine2.my3-domain.tld and my1-machine2
I tried queries like
but that don't work.
Do you understand what I'm doing bad?
When I search for
hostname:"my1-machine2*" I got events with short hostname (a lot) and FQDN (a few). When I use a filter to have hostname: "my1-machine2.my3-domain.tld" I see events which were not visible with my query