Search like Regex

Elastic Stack Elasticsearch
1

Hi, I have a field called message and the content look like this.

"Add: , Delete: 1" (This means no entity is added and entity 1 is deleted)
"Add: 1, Delete: 2"
"Add: 3, 4, Delete: "

How can I search for all the results in which some entities are deleted? In other words, there is some number after "Delete: ".

Thanks!

2

You might be able to do it using a scripted field, but this will probably be slow and not scale well. The better approach is to parse this out and store the relevant data in separate fields at ingest time.

3

Get it. Thanks!