How do I combine wildcard and spaces in a search?
A KQL search for log.message:Core API Request
returns expected matches. But log.message:Core API*
does not.
I'm happy to use either KQL or Lucene.
How do I combine wildcard and spaces in a search?
A KQL search for log.message:Core API Request
returns expected matches. But log.message:Core API*
does not.
I'm happy to use either KQL or Lucene.
Hi Niels!
This is definitely a point we've discussed in the past with regards to KQL (see https://github.com/elastic/kibana/issues/23001).
I believe using Lucene you can do your query something like this:
log.message:Core\ API*
Note the usage of the backslash character \
to escape the space.
Please let me know if that works!
That works. Thanks Lucas.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.