Hello , I want to read output for following
SELECT * FROM "alpha-*" where APILog.req.operationName="submitOrder"
but seems it is failing for the APILog.req.operationName . Can we not use that way in SQL ? I have attached screen from kibana the way it looks.
@Khirod_Panda,
Does the command succeed if you wrap the field name in quotes?
SELECT * FROM "alpha-*" where "APILog.req.operationName"="submitOrder"
One small correction, if I may: if submitOrder is a literal (constant), it should be surrounded by single quotes, not double ones: SELECT * FROM "alpha-*" where "APILog.req.operationName"='submitOrder'.