# Kibana search problem - not finding string

**URL:** <https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711>\
**Category:** Kibana\
**Created:** [August 23, 2018, 11:25am UTC](https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711 "2018-08-23T11:25:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmccuk](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@dmccuk](https://discuss.elastic.co/u/dmccuk)\
**Post date:** [August 23, 2018, 11:25am UTC](https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711/1 "2018-08-23T11:25:25Z")

</div>

Hi,

I'm trying to search for a string in Kibana. It's a metricbeat field called: system.process.cmdline

It's lists out a long Java line like below but fails to find my sting (but finds others). It's driving me a bit potty.

This is the string:

```
"cmdline": "java -Dname=process01 -Dlogback.configurationFile=/file/system/path/process01.1234/bin/../config/DEV/PRS/logback.xml -server -showversion -d64 -Xms512m -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:G1MixedGCLiveThresholdPercent=70 -XX:InitiatingHeapOccupancyPercent=70 ..."

```

I just want to search on - "-Dname" and extract the "process01" name

This search string works:

```
system.process.name : java AND system.process.cmdline : *Djava* AND beat.hostname:server01

```

But this doesn't bring back any results even though i can see it in the sting.

```
system.process.name : java AND system.process.cmdline : *Dname* AND beat.hostname:server01

```

It's a long shot but I'm hoping that this can be explained and I need to add an additional value to my metricbeat.yml to get data out. It's just confusing because I can see dname in the string so it may be something else.

Thanks you in advance for any help you can offer.

Regards

Dennis

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [August 24, 2018, 10:22am UTC](https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711/2 "2018-08-24T10:22:47Z")

</div>

Hello,

Looks like it's a problem stemming from the fact that the field can get over 1024 characters. And in the metricbeat index template, the parameter `ignore_above` is set for 1024, making that document not indexed, which in turn means not-searchable.  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html)

How you can fix this?  
You could edit the template of your metricbeat index and set a larger value for `ignore_above`.  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html)

---

<div class="post-metadata">

**Author:** ![TheCodingKnight](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@TheCodingKnight](https://discuss.elastic.co/u/TheCodingKnight)\
**Post date:** [August 24, 2018, 11:32am UTC](https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711/3 "2018-08-24T11:32:46Z")

</div>

> [@dmccuk](#):
>
> I just want to search on - "-Dname" and extract the "process01" name

How do you go about extracting just a part of the string from the result above?

---

<div class="post-metadata">

**Author:** ![dmccuk](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@dmccuk](https://discuss.elastic.co/u/dmccuk)\
**Post date:** [August 30, 2018, 9:39am UTC](https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711/4 "2018-08-30T09:39:23Z")

</div>

Thanks for your reply @Marius_Dragomir.

You are right, checking the largest document, it was over 27,000 characters which is too big to make searchable in ES. For this reason i switched from metricbeat direct to ES, and instead used filebeat to send over the metricbeat log to logstash.

Slightly more work than i was planning on doing but I now have alot more control over my data. If anyone is interested, this is the regex i used to pull out the field of interest in logstash:

```
filter {
  json {
    source => "message"
  }
  grok {
    match => { "[system][process][cmdline]" => ".*\s-Dname=%{WORD:system.process.appname}\s.*" }
  }
}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 9:39am UTC](https://discuss.elastic.co/t/kibana-search-problem-not-finding-string/145711/5 "2018-09-27T09:39:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.