SNMP output and ES|QL

Elastic Stack Kibana
1

Hello community, i want to know if any of you have knowledge of ES|QL
Im trying to do some viwes for a dashboard and i think this new feature can help but i was unable to do so.

this is an example of the data

snmp
snmp1245×733 159 KB

but as soon i want to search something it just doesn´t work, so its kind of useless

snmp2
snmp21074×725 33.7 KB

any help will be very useful

2

could you try with:

from snmp*
| where tags like "snm*"

?

3

Added esql and removed kql-kibana-query-language

4

no luck, i gave up with ES|QL I think its too new and its not working yet, will wait for the next releases.

5

@Gaston_Beltramelli cc @dadoonet

Please share a document or two...

Tags is an array so that needs to be considered...

There are 2 basic approaches to searching / matching on Arrays

  • Use MV_EXPAND which will create a new row for each tag value and then a simple where tags like "snm*" will work

  • Use MV_CONCAT to concatenate all the tags into a single new string then use the wildcard match

ESQL is GA and works well, could this use case be easier yes, are more functions being added yes...

Hope this helps