[solved] Problems with "/" as value / apache logs in logstash

Elastic Stack Elasticsearch
1

Hi,

I'm pipelining Apache logfiles from logstash to elasticsearch, implemented very close to the example in the logstash docs.

Now when the "request" field just has an / (slash) as value, it appears in the Discover tab

elastic1
elastic1.png1327×603 38.6 KB

However, when I try to filter out just the / requests, it fails.

elastic2
elastic2.png1067×582 37.3 KB

When using the "request" field as grouping term, all the / entries are missing.

Is this kinda bug, or do I have to change something?

EDIT: Switched to Elasticsearch forum, hope someone can help

2

Can at least someone verify this issue?

3

I'd say that probably with the default analyzer / is not indexed at all.
May be change the default analyzer for this field to something like a path tokenizer or search in request.keyword instead ?

4

Yes, you're right, when I use "request.keyword" as search term instead of "request", it works. Weird.
Thank you!