Kibana using query_string and their use of api using bool results are not the same

When i typed in the search bar in the kibana full_info: / * 6F36A507-E4B3-40DE-84B7-CFC66BC2FDB2 * / no results after the search, I used api

{
  "size": 1,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gt": "now-7d",
              "time_zone": "+08:00",
              "lte": "now",
              "format": "yyyy-MM-dd HH:mm:ss"
            }
          }
        },
        {
          "wildcard": {
            "full_info": "*6F36A507-E4B3-40DE-84B7-CFC66BC2FDB2*"
          }
        }
      ]
    }
  }
}

result is right to me

{
  "took": 1066,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "hits": {
    "total": 6,
    "max_score": 0,
    "hits": [
      {
        "_index": "xxx_os_app_log-2017.02.12",
        "_type": "os_app_log",
        "_id": "AVoxSLRUfikyXsXdU-HU",
          "full_info": "IGORSPLIT-894d57eba0424f4381b5e146f611e972-1-2|1x.x.16.46 POST /api/users/login/v2/xxcenter '{"lang": "zh-hk", "origin_user_id": "x39838", "timestamp": "1486885524031", "game_id": "100", "ci": "6F36A507-E4B3-40DE-84B7-CFC66BC2FDB2", "public_key_url": "https://static.gcxxx", "scene": "switch_account", "display_username": "Dsxxdg", "signature": "RsgacUMPvqTutDqAfnHT2zpzCDWBPWIKf1aPv+kxvePDzTmNVbAB9SrPEZTk6EwnZlPNmSwHBcxPCsCrX6aD2wWdssstJDfCWSw6RnwgBBjB8d5Kaaaaa0QkB+k6uzeVc8WW3yDyccKkXk9m0Djh4jngYlZ2J5lJ6o2KvsssS1um6pxMTEPU328q9nEmtfI5Wpt7Yd4CfV5U8A8B/1A16dPTdtSGAbtQszcjWu76Ec9Fs+U4k80PTtlembL3yTmCHmQINcPGvzvWDg==", "player_id": "G:804xx68000", "bundle_id": "xxx", "cp": "i", "salt": "HxxBqQ==", "cv": "1.2.0", "device_id": "3812366"}' -> 200, {"msg": "ok", "code": 0, "alert_type": 0, "user": {"bound_account_types": [2], "login_token": "1-xxxeC1TYksDDk84dYZ6"
        }
      }
    ]
  }
}

What is the difference between the two methods used?

if i want to use kibana search same result, How to achieve?

is one way to go, But it is too difficult for ordinary users

is that clear?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.