# Search on kibana discover dashboard

**URL:** <https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610>\
**Category:** Kibana\
**Created:** [November 29, 2017, 2:23pm UTC](https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610 "2017-11-29T14:23:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![artec](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@artec](https://discuss.elastic.co/u/artec)\
**Post date:** [November 29, 2017, 2:23pm UTC](https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610/1 "2017-11-29T14:23:13Z")

</div>

Hi all,  
this is my first topic so I would say an "Hello!" at everyone !  
I set up an environment with filebeat -\> logstash -\> es -\> kibana to collect our application logs.  
The events are like (stored in message field)

http\> [29/11/2017 15:08:23] GET /multisession/x-2963163/Login  
QRY\> (1 row in 1~1 msec) Select \* From TABLE1 Where ( IDUSER=? ) [1]  
QRY\> (0 rows in 0~0 msec) Select \* From TABLE2 Where ( IDUSER=? ) [1]  
http\> Response in 6 msec. ResponseOk="/login/Home.html"

The problem is if I try a search with a regexp like /[0-9]{3}/ msec , it not consider an unique phrase.  
Sorry for any mistake but I'm a newbie !

Davide

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [November 29, 2017, 9:52pm UTC](https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610/2 "2017-11-29T21:52:29Z")

</div>

Is your field mapped as text? Kibana's running a query string query which will end up passing this through elasticsearch's analyzer, causing it to tokenize on certain characters like spaces.

If it's possible I'd recommend parsing these logs out to individual fields before they reach elasticsearch. You'll be able to run aggregations and queries like show me all requests that take \> 10 ms. You can do this with grok filters in either [elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/grok-processor.html) or [logstash](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)

---

<div class="post-metadata">

**Author:** ![artec](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@artec](https://discuss.elastic.co/u/artec)\
**Post date:** [November 30, 2017, 7:53am UTC](https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610/3 "2017-11-30T07:53:01Z")

</div>

Hi Jon,  
thanks for your reply.  
Yes, I set message like text and not\_analyzed. As you suggest, I set the total request time (from my example, 6) in another field and works fine.  
But if I would search in my events all the query (QRY\> (0 rows in 0~0 msec) Select \* From TABLE2 Where ( IDUSER=? ) [1]) that spent more than 3 msec, how can I do this ?

Thanks a lot  
Davide

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [November 30, 2017, 7:57pm UTC](https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610/4 "2017-11-30T19:57:57Z")

</div>

If you run a match query it'll run both your query and your data through the analyzer - [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html#query-dsl-term-query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html#query-dsl-term-query) for further reading. In the search bar in kibana I'd try something like:

```auto
{ "match": { "my_field": { "query": "(QRY> (0 rows in 0~0 msec) Select * From TABLE2 Where ( IDUSER=? ) [1])" } } }

```

or by creating a filter using the add filter button below the query bar.

Alternatively if you map it as keyword, it won't be run through an analyzer. One thing to keep in mind is there is a [size limit](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/ignore-above.html) on keyword fields at 32766 bytes(~15k characters), so if the queries are longer it may not be an option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2017, 7:58pm UTC](https://discuss.elastic.co/t/search-on-kibana-discover-dashboard/109610/5 "2017-12-28T19:58:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.