Search with colon or Dash

Elastic Stack Kibana
1

Hi,

I am using Kibana for store my logs but I when search fields with colon ( : ) or dash ( - ) I have unexpected results.

Follow some examples:

  • Search for the full text WORKS:

objectId: "this.is.full.text:category:some-title:"

{"query": {
    "match": {
      "objectId": {
        "query": "this.is.full.text:category:some-title:",
        "type": "phrase"
      }}}}
  • Search inside the text without use the dash or colon WORKS also

objectId: "this.is.full*"

{"query": {
    "match": {
      "objectId": {
        "query": "this.is.full*",
        "type": "phrase"
      }}}}
  • But if I included a colon inside the search this NOT WORKS

objectId: "* category:some *" (note: there is no space after or before the *)

{"query": {
    "match": {
      "objectId": {
        "query": "*category:some*",
        "type": "phrase"
      }}}}

I tried escape the colon with bask-slash ( : ) but without success.

2

I believe that it's actually a problem with the match query. From the match query docs:

The match family of queries does not go through a "query parsing" process. It does not support field name prefixes, wildcard characters, or other "advanced" features.

You need to change that to a query_string query to use wildcards correctly.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.