Question about behavior of query_string

Hi,

I was searching for multiple fields in Kibana and I knew that the search string would be part of the query_string. However, there are something I don't fully understand.

When I use an empty string like status:"", Kibana will give me nothing. However, if I combine it with a non-empty string search for another field, like serviceName:"abc" AND status:"", it will return the result of serviceName:"abc" and seems to ignore the status:"". It will be the same if I put characters like * inside, as status:"*".

This really puzzles me. I will be more than grateful if anyone can help me to sort it out. Thank you so much.

Tao

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.