Kibana Regex check if a field contains the value of another

Elastic Stack Kibana
1

Hello,
I'm trying to search for documents in which a description field contains the value of a name field (from another document). I tried to do a Regex query as following :

GET inventory-full-index/_search
{
  "query": {
    "regexp": {
      "description.description_data.value.keyword": ".*doc['name.keyword'].*"
    }
  }
}

It returns me interesting documents, that fit my need. the problem is that i created a document that contains "python3" in the description, and i made sure there was a document named "python3" as well. This query doesn't return this document, so i obviously missed something.
Any idea how to fix this ?

2

"doc['name.keyword']." dosn't work just as a regex pattern? Does it really look up doc['name.keyword']?

And what do you mean by "(from another document)"? The query clause should work on a single document.

1 Like
3

My index contains a list of softwares and a list of CVE, I need to compare the software's name with CVE's description.
I figured out this morning that the documents returned by this query were just CVE that had a field named "name" (even though the mapping was different), containing a word in common with the description.
I guess I have to do the script outside kibana.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.