not able to use wildcards in query

[oweng]

Hi, I am using the latest release of kibana (as of 12-18), and I am having an issue where I am unable to search for some like like eventName:Describe_. My Terms panel is working great, but I would like to get rid of all the "Describe_" events as there are a lot of them. Looking around, I found this, and it sounds like it could be the same issue, but it looks like files have changed and so forth..

https://github.com/rashidkpc/Kibana/issues/363

Thanks for your help.

Geoff

[rashidkpc]

I'm not able to replicate this, foo:ba* works fine for me. How are you trying to use this? In a query object? In the exclude section of the terms panel?

[oweng]

Rashid,

Sorry, inside of the terms panel I have no issues with the exclude or filtering by the term. Where I seem to have an issue is if I create a filter or a search using:

eventName:Describe*

When I do that, I basically don't get anything... Like the filter isn't even there.

I wasn't sure if this is a case-sensitive issue or something like that?

Thanks for your time and help.

Geoff

On Jan 2, 2014, at 5:48 PM, Rashid Khan notifications@github.com wrote:

I'm not able to replicate this, foo:ba* works fine for me. How are you trying to use this? In a query object? In the exclude section of the terms panel?

—
Reply to this email directly or view it on GitHub.

[rashidkpc]

Could be a mapping issue, are you using a template or a defined mapping for that field?

[oweng]

Rashid, sorry for the late response! I am actually only using the logstash template that I think Shay made awhile back. I didn't add anything specifically for this field. Is that something I should do?

Thanks again!

Geoff

On Jan 2, 2014, at 9:20 PM, Rashid Khan notifications@github.com wrote:

Could be a mapping issue, are you using a template or a defined mapping for that field?

—
Reply to this email directly or view it on GitHub.

[rashidkpc]

If you'd like to post the template you're using I can take a look at it.

[oweng]

Rashid,

Thank you, and yes, I would very much appreciate it! So far I have
everything working, just working out the little tweaks everyone seems to
want. :)

{
"template": "logstash-_",
"settings" : {
"number_of_shards" : 1,
"number_of_replicas" : 0,
"index" : {
"query" : { "default_field" : "@message" },
"store" : { "compress" : { "stored" : true, "tv": true } }
}
},
"mappings": {
"default": {
"_all": { "enabled": false },
"source": { "compress": true },
"dynamic_templates": [
{
"string_template" : {
"match" : "",
"mapping": { "type": "string", "index":
"not_analyzed" },
"match_mapping_type" : "string"
}
}
],
"properties" : {
"@fields": { "type": "object", "dynamic": true, "path":
"full" },
"@message" : { "type" : "string", "index" : "analyzed" },
"@source" : { "type" : "string", "index" : "not_analyzed" },
"@source_host" : { "type" : "string", "index" :
"not_analyzed" },
"@source_path" : { "type" : "string", "index" :
"not_analyzed" },
"@tags": { "type": "string", "index" : "not_analyzed" },
"@timestamp" : { "type" : "date", "index" : "not_analyzed"
},
"@type" : { "type" : "string", "index" : "not_analyzed" }
}
}
}
}

Thanks again Rashid! I really appreciate it!

Geoff

On Sun, Jan 5, 2014 at 9:42 PM, Rashid Khan notifications@github.comwrote:

If you'd like to post the template you're using I can take a look at it.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/801#issuecomment-31625671
.

[rashidkpc]

All of your strings are set to not_analyzed. You also appear to be using the old logstash schema. Your best bet would be to delete your template, upgrade to the latest logstash, and, if you want to retain your existing data, reindex. Closing this ticket as it isn't a Kibana bug.

[oweng]

Thanks for the advice Rashid, I just upgraded from 1.2.2 to 1.3.2.

Thanks again,

Geoff

On Mon, Jan 6, 2014 at 9:14 AM, Rashid Khan notifications@github.comwrote:

All of your strings are set to not_analyzed. You also appear to be using
the old logstash schema. Your best bet would be to delete your template,
upgrade to the latest logstash, and, if you want to retain your existing
data, reindex. Closing this ticket as it isn't a Kibana bug.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/801#issuecomment-31655257
.

[kernisr]

@rashidkpc -- I am trying to perform a wildcard exclude in a terms panel. Is there any way to day that as per your question above.