I would like to know how to query a field to exactly match a string.
I'm actually trying to query like this:
url : "http://www.domain_name.com"
Which returns all string starting with http://www.domain_name.com .
I had a similar issue, and ifound that ".raw" fixed it - in your example, try
url.raw : "http://www.domain_name.com"
Or for newer versions of ES(5.x, 6.x):
url.keyword : "http://www.domain_name.com"
Just giving more visibility to #dezhi's comment.
in newer version of ES(5.x, 6.x),
you should use `url.keyword` instead,
as they have changed to a new keyword type.
Therefore, it would be:
url.keyword : "http://www.domain_name.com"
Exact value is not supported out of the box.
http://blogs.perl.org/users/mark_leighton_fisher/2012/01/stupid-lucene-tricks-exact-match-starts-with-ends-with.html
Out of the box, Lucene does not provide exact field matches, like matching "Acer Negundo Ab" and only "Acer Negundo Ab" (not also "Acer
Negundo Ab IgG" ). Neither does Lucene provide "Starts With" or "Ends
With" functionality. Fortunately, there are workarounds.
"Cannot change the info of a user"
To search for an exact string, you need to wrap the string in double
quotation marks. Without quotation marks, the search in the example
would match any documents containing one of the following words:
"Cannot" OR "change" OR "the" OR "info" OR "a" OR "user".
Kibana v6.5
As per you query, it seems fine.
For matching the exact following is the syntax :
fieldname : string
and
For matchign the Substring, use wild card (*),
Syntax :
fieldname : *string*
Also, whatever the query you applied; is that query is the part of Query Criteria of your particuler output component.
So, i suggest you to check whether any of the wild card is applied in your search.
Related
I have solr field stored as -
record1 --> colorDimension : "Purple|91"
record2 --> colorDimension : "Purple|974|91"
record3 --> colorDimension : "Purple|974"
I need to facet on this colorDimension Field in a way such that term contains "Purple" and number "91".
The result I am targeting is -
Purple|91 = 2
I was looking out for facet.contains but did not get any examples that uses regular expressions.
You should expand these while indexing, so that you have a token for Purple|91 and Purple|974 separately. Faceting is quick because it can count tokens, without having to run a regex against each one to find the actual value.
You'll probably have to do this in your code, since I don't think you can make the pattern regex tokenizer spit out multiple tokens for a given prefix / group.
Try using this pattern:
Purple\|(?:\d+\|)*91(?:\||$)
Demo
If you actually need to make use of regular expressions, there is a parameter facet.matches, which can be used to specify a regular expression to restrict the facet results
I'm using an application called Firemon which uses regex to pull text out of various fields. I'm unsure what specific version of regex it uses, I can't find a reference to this in the documentation.
My raw text will always be in the following format:
CM: 12345
APP: App Name
BZU: Dept Name
REQ: First Last
JST: Text text text text.
CM will always be an integer, JST will be sentence that may span multiple lines, and the other fields will be strings that consist of 1-2 words - and there's always a return after each section.
The application, Firemon, has me create a regex entry for each field. Something simple that looks for each prefix and then a return should work, because I return after each value. I've tried several variations, such as "BZU:\s*(.*)", but can't seem to find something that works.
EDIT: To be clear I'm trying to get the value after each prefix. Firemon has a section for each field. "APP" for example is a field. I need a regex example to find "APP:" and return the text after it. So something as simple as regex that identifies "APP:", and grabs everything after the : and before the return would probably work.
You can use (?=\w+ )(.*)
Positive lookahead will remove prefix and space character from match groups and you will in each match get text after space.
I am a little late to the game, but maybe this is still an issue.
In the more recent versions of FireMon, sample regexes are provided. For instance:
jst:\s*([^;]?)\s;
will match on:
jst:anything in here;
and result in
anything in here
I am newbie to ELK. I want to search for docs based on order of occurrence of words in a field. For example,
In doc1, my_field: "MY FOO WORD BAR EXAMPLE" In doc2, my_field: "MY BAR WORD FOO EXAMPLE"
I would like to query in Kibana for docs where "FOO" is followed by "BAR" and not the opposite. So, I would like doc1 to return in this case and not doc2.
I tried using below query in Kibana search. But, it is not working. This query doesn't even produce any search results.
my_field.raw:/.*FOO.*BAR.*/
I also tried with analyzed field(just my_field), though I came to know that should not work. And of course, that didn't produce any results either.
Please help me with this regex search. Why am I not getting any matching result for that query?
I'm not sure offhand why that regex query wouldn't be working but I believe Kibana is using Elasticsearch's query string query documented here so for instance you could do a phrase query (documented in the link) by putting your search in double quotes and it would look for the word "foo" followed by "bar". This would perform better too since you would do this on your analyzed field (my_field) where it has tokenized each word to perform fast lookups. So you search in Kibana would be:
my_field: "FOO BAR"
Update:
Looks like this is an annoying quirk of Kibana (probably for backwards compatability reasons). Anyway, this isn't matching for you because you're searching against a non-analyzed field and apparently Kibana by default is lowercasing the search therefore it won't match the the non-analyzed uppercase "FOO". You can configure this in Kibana advanced settings mentioned here, specifically by setting the configuration option "lowercase_expanded_terms" to false.
Kibana’s standard query language is based on Lucene query syntax.
And the default analyzer will tokenize the text to different words: [MY, FOO, WORD, BAR, EXAMPLE]
Instead of using regex match, you can try the following search string in Kibana:
my_field: FOO AND my_field: BAR
And if your "my_field" data looks like "MYFOOWORDBAREXAMPLE",which can not be tokenized, you should use the query string:
my_field: *FOO*BAR*
GET /_search
{
"query": {
"regexp": {
"user": {
"value": "k.*y",
"flags" : "ALL",
"max_determinized_states": 10000,
"rewrite": "constant_score"
}
}
}
}
More details on here
My regular expression is like this:
.*(kgrj4e|\*)[^:]*:([^;]*);?
The 'kgrj4e' part is a userid and is dynamic. The PR.... parts are printers. If the userid is not found I want the default printer (PR12346).
For first test string below I want result to be PR12345, but I get PR12346
snljoe,snlaks,kgrj4e,snlbla:PR12345;*:PR12346
Note: the users snljoe, snlaks and snlbla are just examples and can be totally different. In fact the list of users can be longer or smaller.
For second test string below I want result to be PR12346
snljoe,snlaks,snlbla:PR12345;*:PR12346
How to fix the regular expression so both test strings give the expected result?
You can get the number with a search and replace:
Search for: ^(?:(?!.*,kgrj4e(?:[;,])).*\*:(\w+)|.*?(PR\d+).*)
Replace with: $1$2
See this demo
I assume that the kgrj4e is a user-defined value that should be missing in the string to match the last printer value. If it is present, the first printer value is returned.
I have a model class with the following property for my country list.
[Required(ErrorMessage = "Please select a country")]
[RegularExpression("^(?!----------------$)", ErrorMessage= "Please select a country")]
public string Country { get; set; }
At the moment when users click on any countries they will get the error message !?
I only need to display the error message when users click on ---------------- option only.
I have already tried couple of other expressions but they seem not work at all.
also tried this : [RegularExpression("/^(?!----------------)$/"
any ideas ?
Use a pattern that matches what is valid of course. Also, do not use opening and closing forward slashes in your pattern.
An easy fix for the pattern you tried is to supplement the negative lookahead with .+:
^(?!----------------).+$
Here is a regex fiddle for the tweaked version of your pattern.
However, I would consider a pattern like the following judging by the countries in your list - and refine it as needed (e.g. for Unicode characters etcetera):
^[A-Z][a-z]+( [A-Z][a-z]+)*( \([A-Z]+\))*$
Here is a regex fiddle for this alternate (starting-point) pattern.