Query with wildcard and space not working

#1

How do I combine wildcard and spaces in a search?

A KQL search for log.message:Core API Request returns expected matches. But log.message:Core API* does not.

I'm happy to use either KQL or Lucene.

#2

Hi Niels!

This is definitely a point we've discussed in the past with regards to KQL (see https://github.com/elastic/kibana/issues/23001).

I believe using Lucene you can do your query something like this:

log.message:Core\ API*

Note the usage of the backslash character \ to escape the space.

Please let me know if that works!

#3

That works. Thanks Lucas.