KQL Query with wildcard and space not working (with wildcard type)

Elastic Stack Kibana
1

Hello,
I used a wildcard field in my index mapping in order to be able to use wilcard in my logs.

Now, I try to select some lines in my logs which begins with "Request finished"

  1. message:Request*
    it is working but there are too much results for me

  2. message:Request finished* or message:"Request finished*" or message:Request finished or message:Request?finished*
    => expand your time range... :cry:

  3. message:Request\ finished*
    the only way I find is to deactivating KQL and using this Lucene syntax

Do you see a way to search it easilly trought KQL ? :face_with_monocle:

Exemple of message I want to match :

Request finished HTTP/1.1 GET http://staging-wmsdevplatform.fmlogistic.fr:5000/api/Size/GetSupportQuantity?activityCode=SDO&depositCode=ECR&supportNumber=336042896110201330 application/json - - 404 0 - 17.1080ms

2

I found KQL not to work well with wildcards. Never managed to make it work as I expect it.
I use query DSL (filter)?

{
  "query": {
    "wildcard": {
      "message": {
        "value": "ki*y",
        "boost": 1.0,
        "rewrite": "constant_score"
      }
    }
  }
}

Another option is a scripted field.
If you can create another field pre-indexing, that is even better.

3

Thank you for your answer AClerk,

the fact is that I searched for a KQL syntax in order to use it easilly trough kibana.
My team will not use any _query api but only kibana querybar

Perhaps I will change elastic mapping and transform my field :

    "message": {
      "type": "wildcard"
    },

into

        "message" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "ignore_above" : 256,
              "type" : "keyword"
            }
          }
        }

But I does not achieve to find which impact it will have on my data in term of search performance & database size

4

You can predefine a filter and your team can just enable/disable it.

I am not sure of the impact to your cluster after the change.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.