Kibana search syntax

Catalog

One Field search

Two wildcard

3、 ... and Regular

Four Fuzzy search

5、 ... and Approximate search

6、 ... and Range search

7、 ... and Logical operation

8、 ... and grouping

Nine Escapes special characters

Ten lucene Syntax reference

---

One Field search

Limited field full text search ：field:value

Exact search ：filed:"value"（ Key words with double quotes  ）

Whether the field itself exists

_exists_:http ： You need to have http Field

_missing_:http ： It cannot contain http Field

Two wildcard

? Match a single character

* matching 0 To more than one character

kiba?a, el*search

? * Can't be used as the first character , for example ：?text *text

3、 ... and Regular

es Support some regular functions

mesg:/mes{2}ages?/

Four Fuzzy search

~  : Add... After a word ~ Enable fuzzy search

first~  It can also match frist

5、 ... and Approximate search

Add... After the phrase ~

"select where"~3 Express select and where In the middle 3 Within words .

6、 ... and Range search

Numeric and time type fields can query a range

status:[200 TO 400]

date:{"now-6h" TO "now"}

[ ] Indicates that the endpoint value is included in the range ,{ } Indicates that the endpoint value is not included in the range .

7、 ... and Logical operation

AND   

OR

+ ： This item must be included in search results
- ： This item cannot be included
+apache -jakarta test ： There must be apache, Can not have jakarta,test not essential .

8、 ... and grouping

(jakarta OR apache) AND jakarta

Field grouping

title:(+return +"pink panther")

Nine Escapes special characters

+ - && || ! () {} [] ^" ~ * ? : \

The above characters need to be used when searching as values \ escape

Ten lucene Syntax reference

https://lucene.apache.org/core/5_2_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html

WeChat official account ：「 A new ape 」, Wechat scan .