Search for a substring within a specific field

(gearoid houston) #1


Is it possible in kibana to search for a substring contained within a specific field?

Search for a string within a specific field
(Thomas Neirynck) #2

hi @ghouston10,

I think the answer is, it depends.

  1. In any place you would be using Painless, for example, in Kibana's scripted fields, you can use Regex to do substring matches on a field-value.

See here for an example: Substring in painless

  1. You can also do prefix-queries with lucene using the wildcard character. So in the Kibana query-bar, you could do something like url:https* to search for all https calls. The wildcard query in lucene cannot be put at the start of a string. More info on that here:

(gearoid houston) #3


Thanks for the reply. I would be performing the search using dev tools within Kibana. How would it be implemented there?


(Thomas Neirynck) #4

In the console, you would just put raw ES-queries. You probably want to look at the regexp searching:

Note that this only works on keyword fields, not on analyzed fields.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.