Searching substring with escape characters

(Pablo Rovedo) #1

Hi Everyone, I need to search messages contain the following substring of escape characters: "~$". I tried escaping with \ but with Kibana Visualize no result was found. Anyone can help me or give me some tips to solve it?

Thanks in Advance

(Spencer Alger) #2

This will probably only scale if you index your data in elasticsearch so that those terms are searchable. By default ES assumes the data is "text", which should be searchable using words. I suggest describing your data a bit, sharing your mappings, and asking in the elasticsearch forum for the best way to index your data for getting the results you seek.

If reindexing your data isn't an option then you could probably use regex on the specific field you are interested in, but I believe you will need a keyword version of that field (aka not-analyzed, meaning it hasn't been stripped of punctuation or other characteristics that are typically not meaningful when searching through text).

(Pablo Rovedo) #3

ok, maybe if I explain in more detail what I need you'll understand better. I just want to set a kibana Discover filter to filter out all the records where the field "filename" contains a substring "~$" which means, in windows fs envirnoment, that is a temporary file,. For this reason , is important leave out of analysis that kind of files.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.