Kibana's filter (partial matching)

[alexus]

I'm running elasticsearch 5.5.1 and while trying to follow Partial Matching | Elasticsearch: The Definitive Guide [2.x] | Elastic, I was not able to do partial matching through Kibana's filter(

My filter:

{
  "query": {
    "match": {
      "bin": {
        "query": "414720*",
        "type": "phrase"
      }
    }
  }
}

Please advise.

[rashmi (kulkarni)]

@alexus

partial matching through Kibana’s filter

Yes, you could possibly use the kibana filters to achieve this. Just use the part of the word you want to match?

Thanks
Rashmi

[alexus]

@rashmi if I use parts of my query, I do NOT get any match(

[rashmi (kulkarni)]

I don't understand your q. Can you plz rephrase it ?

[alexus]

@rashmi

I have field that contains 6-7 digits:

• if I use 6 digit inside of filter - I get no match
• if I use 6 digit in search field (above filter) - I get partial match.

Why do I not get partial match using filter? How can I do partial match using filter instead of search?

[LeeDr (Lee Drengenberg)]

Here's one way to make it work. I'm not sure it's the only way or even the best way.

If you create a filter, and then edit it;

You can change your query to be like this;

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "bin:414720*",
            "analyze_wildcard": true
          }
        }
      ]
    }
  }
}

It seems like there could be an option like "contains" in the Add filter dialog to do this. I'll check and see if there's any enhancement request for something like that.

Regards,
Lee

[LeeDr (Lee Drengenberg)]

I should mention how I got the query to do this very easily. I just used the query bar to search, and then clicked the little ^ under the histogram and looked at the request. Then copied that bit of the query. Then created a filter and edited it.

[Bargs (Matt Bargar)]

I would use a wildcard query instead of a query string query. If it's a number field a range query should work also.

The query in the original post does not work because the match query does not support wildcards.

[rashmi (kulkarni)]

I raised an enhancement request for the same here: https://github.com/elastic/kibana/issues/13943

you can subscribe to the issue above to get more updates.

Thanks
Rashmi

[alexus]

unfortunately there is no "contain", there are only followings: "is", "is not", "is one of", "is not one of", "exists", "does not exists".

I'm not quite sure how you create query (manually?), but I did noticed you now have query_string, can you please explain step by step how to get there?

[Bargs (Matt Bargar)]

@alexus When you've got the filter editor open, click the "Edit Query DSL" link in the top right corner of the editor. Here you can type in raw elasticsearch query DSL.