Lucene to Kuery

Elastic Stack Kibana
1

Hi,
I'm trying the Kuery language in Kibana 6.3.1 but there's a few things I wasn't able to achieve.

I can't find a way to query data with a space and a wildcard, like this lucene query:
nginx.access.user_agent.os:Mac\ OS*

When I try the same query in Kuery, I get an error message stating that I'm using an old Kuery syntax
When I remove the escape character (as Kuery is not breaking the query on whitespaces anymore if I understood well), I get no results:
nginx.access.user_agent.os:Mac OS*

I also have issues when trying to query on a range, like this lucene query:
nginx.access.response_code:[400 TO 499]

When running a similar query in Kuery, I have no results with an error on shards

Is this possible to run this kind of query using Kuery?

Edit : Fixed formatting of queries

2

Hello Hervé,

I was able to run a similar Kuery query using quotes to include the space. Translated to your query, this would be:
nginx.access.user_agent.os: "Mac OS"
For your range question, the new syntax for this range is:
nginx.access.response_code > 400 AND nginx.access.response_code < 499

-Aaron

3

Thanks for your reply @Aaron_Caldwell
Indeed, that's another way to write a range query.

For the first one, your example doesn't include the wildcard character. The query in Lucene will select all value starting with "Mac OS" whereas the one you suggested select all values equal to "Mac OS". At least that's what it does when I try it.

4

I did omit the wildcard character, but you should be able to include that in the quotes for your query:
nginx.access.user_agent.os: "Mac OS*"

5

When I run the query this way, it seems to consider "Mac OS*" as a phrase, so it consider * as a plain character and returns no results.

In the browser network log, it seems to run the query as a match phrase:
"should":[{"match_phrase":{"nginx.access.user_agent.os":"Mac OS*"}}]

6

I was going to direct you to try using the .keyword version of this field (assuming it exists in your case) however we were unable to get it working locally. Wildcard support is still under active development so it appears this may be a bug, we've submitted it here:

Sorry for the trouble but I appreciate you bringing it to our attention!

7

Thanks! I'll keep an eye on the bug report then

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.