Regexp in Timelion/Kibana query


(Dreadlocked) #1

Hi, I need to find logs whit specific text inside the "message" field. For example, I need to do something like:

.es(q='event_id=XXXX AND message:"/WORD1|WORD2|WORD3|WORD4/")

I only find examples for doing thins like: message:"WORD*" but that's not what I want.


(Jon Budzenski) #2

It looks close, does your query work if you remove the double quotes and close the single quote?
.es(q='event_id=XXXX AND message:/WORD1|WORD2|WORD3|WORD4/')


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.