Recently i used hostname: ".*" which doesnt give any result surprisingly, since two weeks back it was working perfect.
is there anything i am missing here and i need to have work around for it.
Thanks in advance
Hi @saravanan_kutty,
the wildcards as used in your query are not regular expression patterns. As such, the query would match all hostnames that start with a dot. Is that your intention?
for eg: application: "myapplication" AND hostname: (".*")-> list all the host under "myapplication"
.* here means "match all hostnames that start with a ." assuming that field was indexed as a keyword. Otherwise the analyzer would probably remove the . as punctuation.
Maybe you can give us an example of one or two documents that you want to filter for?
we have indexed the hostname,application as keyword.
{
"query": {
"match": {
"hostname": {
"query": ".*",
"type": "phrase"
}
}
}
}
{
"query": {
"match": {
"clustername": {
"query": "mycluster",
"type": "phrase"
}
}
}
}
we just wanna know how to filter all hostname irrespective of what it start with specific cluster.
If you don't want to use a field hostname as a filtering criterion, you can just not mention it in the query. So assuming you have keyword fields hostname, clustername and applicationname, you should be able to query them using simple queries like this: clustername:cluster1 AND (applicationname:application1 OR applicationname:application2).
Sorry if I still don't understand you correctly. Maybe a sample of the documents would make it clearer to me.
@weltenwort
We are programmatically handle the kibana url, so building a generic Kibana URL there we will be having assigning values to a variable for keyword. For few keyword we don’t have value to assign to variable.
Here is the challenge to assign a value to variable for keyword which doesn’t have a value, we can’t have null value to it. A month back this url is working when we used to give (“.*”) as value for which there is no value. I Wonder all of the sudden this is not working
Now we need to find Work around for this wildcard.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.