Query with wildcard and space not working

How do I combine wildcard and spaces in a search?

A KQL search for log.message:Core API Request returns expected matches. But log.message:Core API* does not.

I'm happy to use either KQL or Lucene.

Hi Niels!

This is definitely a point we've discussed in the past with regards to KQL (see https://github.com/elastic/kibana/issues/23001).

I believe using Lucene you can do your query something like this:

log.message:Core\ API*

Note the usage of the backslash character \ to escape the space.

Please let me know if that works!

That works. Thanks Lucas.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.