Special Character in query - Kibana

Elastic Stack Kibana
1

Hi There,

I am looking for a way to search in Kibana with special characters. I have a field with plaintext json as value like:
{"Total":2,"Data":[{"CompareName":"demo","CompareIsActive":true},"CompareName":"demo","CompareIsActive":false}]}

I want to search on Kibana with keyword: "Total":2 but i always receive error or no data returned.

Please advise.

Thanks in advance.

2

I would suggest looking into what Elasticsearch is doing with that field when the document is indexed. I think the default analyzer might strip out the quotation marks when it is creating tokens. I might also suggest that it would work out better to treat those plaintext json fields as their own documents and to index those separately. This would allow you to do field searches on the data like what you are trying to do.

3

Hi Bill,

Thanks a lot for your reply. As far as I checked in json content, the data in json body is like "{"Total":2,"Data..}"

I have tried to searched with escapse character and no escapse character but no luck. The query just match in case of absolutely search, likely search is not.

Could you please advise?

Thanks in advance.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.