Kibana search with partial match



I have a field called ipclient inside my properties. It is of string type because I was not able to change its type and by default if you create the index with log4net.elasticsearch it is set as string.
Anyway now I would like to do a search of all the ips that start with 10.20.1. but I am not able to do it. Is it possible? How?

(Joe Fleming) #2

The string type is not ideal, but it could still work if the field is not analyzed, or if you have a non-analyzed (perhaps named .raw) version of it.

Your best bet is probably to re-index the data and set the mapping correctly instead of using string though.

(system) #3