Query Match text starting with exclamation mark (!)

Elastic Stack Kibana
1

Hi,

I am trying to look for values in a free form text field which may start with the exclamation mark (!) and exclude it from the results. But I can’t figure out what to put in the query input in the Kibana Discover.

I have tried:

content:/\!.+/

I have also tried using filters syntax:

{
  "query": {
    "regexp": {
      "content": {
        "value": "\!.+"
      }
    }
  }
}

no errors. Just no results found. Can you help?

2

Hey @smlbiobot is the content field currently "analyzed"? The standard analyzer in Elasticsearch will remove the ! from the resultant tokens which might be adding to the complexity.

If you have a "keyword" multi-field that isn't analyzed, you should be able to do this following: !content.keyword:\!*

3

Oh sweet! That works like magic. Thanks so much!

4

@Brandon_Kobel ok and say if I want to create filter OR use something like that in Visualize, is there a way to store it somewhere and give it a name? Is this something I would do in scripted filters? And if it is, how would I type that?