Text search in Kibana

[fredrick.bb (Fredrick Yessaian)]

Hello,

I have application log message with following details as message : " some message; partition=-1;offset=-1;lag=275545;RetryCount=0; some message ".

All my message will have "lag=". "lag" is a key comes as a part of message. I need to query to find out lag value greater than 500 or with in a range.

What is the query syntax should I give get extract based on my message.

Thanks

[matw (Matthias Wilhelm)]

Hi
The recommended way would be to extract this value when ingesting data. This could be done with e.g. with logstash or using the Elasticsearch ingest pipeline. Would that be an option for you?
Best,
Matthias