Kibana's filter (partial matching)

Elastic Stack Kibana
1

I'm running elasticsearch 5.5.1 and while trying to follow Partial Matching | Elasticsearch: The Definitive Guide [2.x] | Elastic, I was not able to do partial matching through Kibana's filter(

My filter:

{
  "query": {
    "match": {
      "bin": {
        "query": "414720*",
        "type": "phrase"
      }
    }
  }
}

Please advise.

2

Yes, you could possibly use the kibana filters to achieve this. Just use the part of the word you want to match?

Thanks
Rashmi

21 PM
21 PM2814×1112 230 KB

3

@rashmi if I use parts of my query, I do NOT get any match(

1 Like
4

I don't understand your q. Can you plz rephrase it ?

5

@rashmi

I have field that contains 6-7 digits:

  • if I use 6 digit inside of filter - I get no match
  • if I use 6 digit in search field (above filter) - I get partial match.

Why do I not get partial match using filter? How can I do partial match using filter instead of search?

6

Here's one way to make it work. I'm not sure it's the only way or even the best way.

If you create a filter, and then edit it;

image
image.png927×800 52.4 KB

You can change your query to be like this;

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "bin:414720*",
            "analyze_wildcard": true
          }
        }
      ]
    }
  }
}

It seems like there could be an option like "contains" in the Add filter dialog to do this. I'll check and see if there's any enhancement request for something like that.

Regards,
Lee

2 Likes
7

I should mention how I got the query to do this very easily. I just used the query bar to search, and then clicked the little ^ under the histogram and looked at the request. Then copied that bit of the query. Then created a filter and edited it.

image
image.png1354×668 44.4 KB

8

I would use a wildcard query instead of a query string query. If it's a number field a range query should work also.

The query in the original post does not work because the match query does not support wildcards.

9

I raised an enhancement request for the same here: https://github.com/elastic/kibana/issues/13943

you can subscribe to the issue above to get more updates.

Thanks
Rashmi

10

unfortunately there is no "contain", there are only followings: "is", "is not", "is one of", "is not one of", "exists", "does not exists".

I'm not quite sure how you create query (manually?), but I did noticed you now have query_string, can you please explain step by step how to get there?

11

@alexus When you've got the filter editor open, click the "Edit Query DSL" link in the top right corner of the editor. Here you can type in raw elasticsearch query DSL.

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.