Filter square brackets on Kibana

Question

I'm struggling to filter square brackets on my log messages in Kibana. Suppose I have the messages:

[BOOK] The Book 32 was sold
Exception on buying BOOK

And I want to filter only messages having exactly [BOOK] (so I should get only the first one).

I have tried filtering free text with all kinds of escaping I could think of:

[BOOK]
"[BOOK]"
\[BOOK\]
"\[BOOK\]"
\\[BOOK\\]

And also tried filtering by the message field:

message: [BOOK]*
message: "[BOOK]*"
message: \[BOOK\]*
message: "\[BOOK\]*"

But Kibana seems to simply ignore the square brackets and always brings both messages, highlighting only the BOOK word.

How can I force it search for the []?

score 3 · Accepted Answer · answered Jan 13 '20 at 23:29

3

if your message field is an analysed text, then the brackets are dropped by the analyzer. You should run your query against a keyword data type. More precisely, you will need to run a regexp against a keyword data type, such as a prefix or a wildcard query.

Let's assume that the mapping of message is keyword. If [BOOK] is always at the beginning of your log message, then a valid query is the following:

{ "query": {
  "prefix": {
    "message": "[BOOK]"
  }
}}

If instead you would like to search for [BOOK] in any part of the message value, then you would need something like:

{ "query": {
  "wildcard": {
    "message": "*[BOOK]*"
  }
}}

answered Jan 13 '20 at 23:29

glenacota

2,314
1
11
18

2

Thanks for the answer, @glencota. I understand very little about Kibana, so it didn't make much sense to me what you said n_n'. BUT, I found out that my kibana offers the field `message.keyword`. Using your query with this field worked! Thanks! :D – João Menighin Jan 14 '20 at 13:13
3

hi João, glad that works. However, what I wrote doesn't have much to do with Kibana (which is "just" a UI), but rather with Elasticsearch. If you are going to spend more time querying Elasticsearch, I *totally* recommend you to read about the notion of index mapping https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html – glenacota Jan 14 '20 at 13:41

Filter square brackets on Kibana

1 Answers1