Kibana Timelion: how to query a specific value expression with space

[narschang]

Hello,

I am on Kibana 6.2.4 and I couldn't get the following Timelion visualization working right.

.es(index="bug_elk_prod", timefield="open_date", q="(found_in_rv: 'AGM 9.0') AND (target_rv:PARENT)").label("Found in AGM 9.0").color(#00BFFF).bars()

The visualization of this query came out as same as my other Timelion visualization - in which q="(found_in_rv: '9.0') AND (target_rv:PARENT)") the value "9.0" is the only difference. Please see the screenshot attached to this discussion.

It seems like the query of 'AGM 9.0' didn't go through. How could I make it right to get the data associated with "AGM 9.0"? Thanks.

Nars

[jen-huang]

Try swapping the single and double quotes:

@narschang

q="(found_in_rv: 'AGM 9.0') AND (target_rv:PARENT)"

q='(found_in_rv:"AGM 9.0") AND (target_rv:PARENT)'

[narschang]

Hello Jen,

Just tried it and it worked. Thanks a lot!!

Nars

[narschang]

Got a follow up up question:

.es(index="bug_elk_prod", timefield="open_date", q='(found_in_rv:"9.0" OR found_in_rv:"AGM 9.0") AND target_rv:PARENT').label("Found in 9.0 and AGM 9.0").color(#00BFFF).bars()

The query (found_in_rv:"9.0" OR found_in_rv:"AGM 9.0") is picking up only the 9.0 data but not AGM 9.0 data. How do I make this OR expression right?

Thanks a lot.

Nars

[jen-huang]

@narschang

(found_in_rv:"9.0" OR found_in_rv:"AGM 9.0")

This looks correct. What is the mapping of found_in_rv field?

If type is set to text, querying for 9.0 will match both 9.0 and AGM 9.0 (so there is no need for the second OR condition.

If type is set to keyword, querying for 9.0 will only match 9.0.

Elasticsearch may have created found_in_rv.keyword for you as well, so you can try:
(found_in_rv.keyword:"9.0" OR found_in_rv.keyword:"AGM 9.0")

More information here: Timelion query - #2 by Stacey_Gammon

[narschang]

Thank you, you are right. This euery is 9.0 and AGM 9.0 inclusive. It's now working after I changed my query from target_rv:9.0 to target_rv.keyword:9.0.

Thank you!!!

Nars