Kibana wildcard query does not return any data

[dulman]

Hello,

we are forwarding application logs via filebeat to elasticsearch. We want to filter/search these logs for upcoming exceptions.

When I search for Exception kibana does not return any data:

But when I manually search for exceptions in kibana I find logs (exceptions) like this:

Why?

We are using Kibana/Elasticsearch with version 5.5.0

[timroes]

Hello,

I would think the issue you are running into, is that the values of these field are too long (above the ignore_above value of your mapping) and thus not indexed for searching. This is a common issue when storing stack traces. I tried to write in this blog post about that issue and how you can check your mapping.

If that is the issue, you should adjust your mapping, to increase the ignore_above size if you want to search also long field values.

Cheers,
Tim

[dulman]

Thank you Tim!