Query against a list of objects

Elastic Stack Elasticsearch
1

Hello, we're currently using winlogbeat to send domain controller logs to Elasticsearch and I was wondering how I would query against a list of objects, for example a list of usernames. After looking into it I think I need to so something with 'terms queries' (https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-terms-query.html)

I did create a document with a list of usernames but couldn't figure out how to query against it, particularly whilst using Kibana with the winlogbeat-* index pattern - can anyone help with this?

Thanks.

2

I'm not sure about kibana, but you shouldn't need to create a document. You can use the list of terms.

If the list is short (like, less than 100) it is probably just fine to do a bunch of term queries in a should clause in a bool query. If you use the query_string query (which I think kibana does in that big text box) that'd look like (field:value | field:value | field:value).

3

Thanks for getting back to me; yes I suppose I could just create a list of query terms in the text box and save it. Just for the future though in case I do need to query against a large list of objects in a document, can you give me an example of such a query?

4

The Elasticsearch example is at the bottom of the page you linked. I'm not sure about kibana, sorry!

5

No worries thanks for getting back to me.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.