7

I am trying to query kibana logs where the message contains the substring "Bla" with the search query - "Bla" and the search query "@message: "Bla" ".

The search will find logs with messages that have the word "Bla" with spaces - like a message "The operation failed for object Bla during insert.".

The search will not find logs with a message containing the word "Bla" with no spaces - like a message "Error:Bla,failed for insert.".

How do I make a query the will find both types of messages?

2
  • Seems like the problem was in the Kibana environment setup, in one environment searching "Bla" finds logs with or without spaces before the word. In the other environment, searching "Bla" finds only logs without spaces before the word "Bla". I compared all of the settings and indexes between both environments and they look the same. Commented Sep 3, 2020 at 7:17
  • See stackoverflow.com/a/71618486/520567 Commented Oct 18, 2022 at 10:47

2 Answers 2

10

Try searching *Bla* (Note: Without any quotes)

3
  • This solves the problem in our Kibana environment that has this problem. Thanks! Commented Sep 3, 2020 at 7:18
  • message : *LanaiBotapr1 * Thank you , I wanted to search for this string in whole message , so it helped too. Commented Apr 9, 2021 at 4:13
  • no need of the asterisks Commented Oct 18, 2022 at 10:47
3

You can try with:

  • *Bla* (Without any quotes) --> search for a string that have "Bla" in any position.

i.e: diploBlastic, resemBlance etc will be in search result

  • *Bla (Without any quotes) --> search for a string that will end with "Bla".

i.e: kiBla, doBla etc will be in search result

  • Bla* (Without any quotes) --> search for a string that will start with "Bla".

i.e: Blank, Black etc will be in search result

1
  • I want to find ? but its a special wildcard character, seems to be no way to esacape it
    – radtek
    Commented Mar 24, 2023 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.