Kibana using query_string and their use of api using bool results are not the same

Elastic Stack Elasticsearch
1

When i typed in the search bar in the kibana full_info: / * 6F36A507-E4B3-40DE-84B7-CFC66BC2FDB2 * / no results after the search, I used api

{
  "size": 1,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gt": "now-7d",
              "time_zone": "+08:00",
              "lte": "now",
              "format": "yyyy-MM-dd HH:mm:ss"
            }
          }
        },
        {
          "wildcard": {
            "full_info": "*6F36A507-E4B3-40DE-84B7-CFC66BC2FDB2*"
          }
        }
      ]
    }
  }
}

result is right to me

{
  "took": 1066,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "hits": {
    "total": 6,
    "max_score": 0,
    "hits": [
      {
        "_index": "xxx_os_app_log-2017.02.12",
        "_type": "os_app_log",
        "_id": "AVoxSLRUfikyXsXdU-HU",
          "full_info": "IGORSPLIT-894d57eba0424f4381b5e146f611e972-1-2|1x.x.16.46 POST /api/users/login/v2/xxcenter '{"lang": "zh-hk", "origin_user_id": "x39838", "timestamp": "1486885524031", "game_id": "100", "ci": "6F36A507-E4B3-40DE-84B7-CFC66BC2FDB2", "public_key_url": "https://static.gcxxx", "scene": "switch_account", "display_username": "Dsxxdg", "signature": "RsgacUMPvqTutDqAfnHT2zpzCDWBPWIKf1aPv+kxvePDzTmNVbAB9SrPEZTk6EwnZlPNmSwHBcxPCsCrX6aD2wWdssstJDfCWSw6RnwgBBjB8d5Kaaaaa0QkB+k6uzeVc8WW3yDyccKkXk9m0Djh4jngYlZ2J5lJ6o2KvsssS1um6pxMTEPU328q9nEmtfI5Wpt7Yd4CfV5U8A8B/1A16dPTdtSGAbtQszcjWu76Ec9Fs+U4k80PTtlembL3yTmCHmQINcPGvzvWDg==", "player_id": "G:804xx68000", "bundle_id": "xxx", "cp": "i", "salt": "HxxBqQ==", "cv": "1.2.0", "device_id": "3812366"}' -> 200, {"msg": "ok", "code": 0, "alert_type": 0, "user": {"bound_account_types": [2], "login_token": "1-xxxeC1TYksDDk84dYZ6"
        }
      }
    ]
  }
}

What is the difference between the two methods used?

if i want to use kibana search same result, How to achieve？

is one way to go, But it is too difficult for ordinary users

2

is that clear?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.