Strings query

(陈浩) #1

kibana 5.4 + es 5.4
I want to terms the suffix of the url.keyword,such as docs or doc or zip...etc.

url.keyword field content like 'abcde.html','','abcde**222.doc'...

How to do that.

Thanks for your help.

(Marius Dragomir) #2

Best way to do this is to create url.keyword.extension at ingest, but if that is not possible, you could create a scripted field to parse the string and create a new scripted field that only has the data from last . to the end of the string.
You can find good examples here:

(陈浩) #3

Thanks for your advice.Scripted field is good idea.

If don't want to add field,just do query in es.Can I do that such as using distinct(substr) by SQL.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.