seach higher than in a message field

Elastic Stack Elasticsearch
1

Message field , is SUCCES Sending eenheidUpdated to URL https://xx.local Time elapsed: 7xx milliseconds, ( 7xx different values)

search with:
message: "time elapsed" and https://xx.local/ and 700

The results are:
SUCCES Sending eenheidUpdated to URL [ttps://xx.local Time elapsed: 700 milliseconds

I want to search higher and equal than 700 , how can I do this ??

2

Hi @Joost2,

Welcome! You'll need to extract the number (or use a numerical field if you have the value in another field) and then perform the comparison to find those great than the value you need.

There's a couple of ways to do it depending on how you are ingesting your data (grok filter in logstash or processor in an ingest pipeline for example). If you don't have the value in a numerical field anywhere you could potentially use a runtime field to extract the value and then search with a gte operator on the value. This post should help you get started with a matcher example.

Hope that helps!