Kibana4 Beta3: Battling with wildcard search on not_analyzed fields

Hi,

I really haven't found a consistent way to use query window in Discover or
Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache Hits"
And I have to escape only backslashes (well I am using double quotes so it
is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and I
have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_"
"\Total Local Cache Hits"
(nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.
)\Total Local Cache Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8670910d-2fef-485f-ba6d-7e32851be397%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Anyone please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover or
Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so it
is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_"
"\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.
)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/989971d3-3c4d-49ce-82bb-8dbfe7e559f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover or
Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so it
is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_"
"\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.
)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

It looks like your field is analyzed and you are trying to query it
assuming its not_analyzed (e.g. one string). Hard to say without seeing
your index mapping.

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover
or Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so
it is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_"
"\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.
)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4Ztkn6wx%2BJB8iJVyLwmZTbX30SKuFkZOvZ38E-96guj7eQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Thanks for responding.

It is surely not_analyzed - hence my frustration. Here is the mapping

{
"my_index": {
"mappings": {
"my_type": {
"properties": {
"@timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"CounterName": {
"type": "string",
"index": "not_analyzed"
},
"CounterValue": {
"type": "double"
},
"DeploymentId": {
"type": "string",
"index": "not_analyzed"
},
"EventTickCount": {
"type": "long"
},
"PartitionKey": {
"type": "string",
"index": "not_analyzed"
},
"Role": {
"type": "string",
"index": "not_analyzed"
},
"RoleInstance": {
"type": "string",
"index": "not_analyzed"
},
"RowKey": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}

On Monday, 2 February 2015 13:20:49 UTC, Itamar Syn-Hershko wrote:

It looks like your field is analyzed and you are trying to query it
assuming its not_analyzed (e.g. one string). Hard to say without seeing
your index mapping.

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi <alio...@gmail.com
<javascript:>> wrote:

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover
or Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so
it is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local
Cache Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_"
"\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.
)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Can you try executing a simple term query in JSON using that query bar?

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 11:57 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

Thanks for responding.

It is surely not_analyzed - hence my frustration. Here is the mapping

{
"my_index": {
"mappings": {
"my_type": {
"properties": {
"@timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"CounterName": {
"type": "string",
"index": "not_analyzed"
},
"CounterValue": {
"type": "double"
},
"DeploymentId": {
"type": "string",
"index": "not_analyzed"
},
"EventTickCount": {
"type": "long"
},
"PartitionKey": {
"type": "string",
"index": "not_analyzed"
},
"Role": {
"type": "string",
"index": "not_analyzed"
},
"RoleInstance": {
"type": "string",
"index": "not_analyzed"
},
"RowKey": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}

On Monday, 2 February 2015 13:20:49 UTC, Itamar Syn-Hershko wrote:

It looks like your field is analyzed and you are trying to query it
assuming its not_analyzed (e.g. one string). Hard to say without seeing
your index mapping.

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi alio...@gmail.com
wrote:

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover
or Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so
it is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local
Cache Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying
to look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits and I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_"
"\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.
)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtkdXHJkBMLP_2Hjobzt06d0aCJj0MbmaskaqMSKRWh%3DQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

This works (exact value)

{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_5412)\Failure
Exceptions"}}

But NOT this:
{"term":{"CounterName":"Caching"}}
Nor
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
Or this
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_
)\Failure
Exceptions"}}

And not even this
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.+)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_
)\Failure
Exceptions"}}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

inline

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 1:32 AM, Ali Kheyrollahi aliostad@gmail.com wrote:

This works (exact value)

{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_5412)\Failure
Exceptions"}}

As expected

But NOT this:
{"term":{"CounterName":"Caching"}}
Nor
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
Or this
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_
)\Failure
Exceptions"}}

As expected too - term query will take the entire string and look for
documents matching this exact query. .* has no meaning in this context, its
just a different string than the original, hence no hits.

And not even this
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.+)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_
)\Failure
Exceptions"}}

I believe you should escape the parenthesis, this is getting parsed as a
regex grouping. See
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvNWEKQ6_j3aEBrJX0vfBJX9APVQja1CqzBMjpyynZypA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp_.\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.
\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead?
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp_.\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.
\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvQkHvs2%2B2K0b53%2BJaFdP6qmiRWJvZU5hLKx0kgQj%3DCWA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure Caching:Client(w3wp_*)\Failure
Exceptions"}}

And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:

On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:

Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead?
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi <alio...@gmail.com
<javascript:>> wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp_.\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.
\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Here's a working gist:

You need to double escape the slashes - not sure if this is by design or no
but that works now

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 7:56 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure
Caching:Client(w3wp_*)\Failure Exceptions"}}

And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:

https://github.com/elasticsearch/kibana/issues/2698

On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:

Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead? http://www.elasticsearch.org/guide/en/
elasticsearch/reference/current/query-dsl-wildcard-query.html

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi alio...@gmail.com
wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure Caching:Client\(w3wp_.\)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching\:Client\(w3wp_.
\)\Failure
Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtYtioqUuAyGWm%3DBf3Jxs8DpUvKUjeTsALO4m38-%3DOr8A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Thank you.

That is the same with regexp. I managed to get it working with using 4
backslashes.

On Wednesday, 4 February 2015 00:20:10 UTC, Itamar Syn-Hershko wrote:

Here's a working gist:

https://gist.github.com/synhershko/3d915a7819145f2d7a1f

You need to double escape the slashes - not sure if this is by design or
no but that works now

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 7:56 PM, Ali Kheyrollahi <alio...@gmail.com
<javascript:>> wrote:

Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure
Caching:Client(w3wp_*)\Failure Exceptions"}}

And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:

https://github.com/elasticsearch/kibana/issues/2698

On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:

Thinking of it, I'm not sure why you are using regexp here - can you
just use wildcard query instead? http://www.elasticsearch.org/guide/en/
elasticsearch/reference/current/query-dsl-wildcard-query.html

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi alio...@gmail.com
wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure Caching:Client\(w3wp_.\)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.
\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9607bc7a-f1d3-40fe-bcbc-732b23cfc734%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.