A request recently came up regarding querying documents with special characters and wildcards.
For example, given the following documents:
{
"span.name": "Elasticsearch: POST /tmp-*/_search"
}
{
"span.name": "Elasticsearch: POST /.kibana/_search"
}"How do I filter for documents where the stuff inside the forward slashes does not start with a dot?"
They had tried several combinations of things with the wildcard inside of quotes, which doesn't work (we should make this explicit inside the docs). The answer ultimately came down to a combination of escaping special characters and wildcards:
span.name: Elasticsearch\: POST /*/_search AND NOT Elasticsearch\: POST /.*/_search
The follow-up question then was "What if the value contained and or or?" And the answer is to also escape keywords (which I don't think we have anywhere inside our docs): /and
We should add some more detail to our docs for these two things:
- Wildcards cannot be used inside quotes. If using wildcards, don't use quotes and escape all special characters.
- How to escape keywords (
and/or/not)
A request recently came up regarding querying documents with special characters and wildcards.
For example, given the following documents:
{ "span.name": "Elasticsearch: POST /tmp-*/_search" } { "span.name": "Elasticsearch: POST /.kibana/_search" }"How do I filter for documents where the stuff inside the forward slashes does not start with a dot?"
They had tried several combinations of things with the wildcard inside of quotes, which doesn't work (we should make this explicit inside the docs). The answer ultimately came down to a combination of escaping special characters and wildcards:
span.name: Elasticsearch\: POST /*/_search AND NOT Elasticsearch\: POST /.*/_searchThe follow-up question then was "What if the value contained
andoror?" And the answer is to also escape keywords (which I don't think we have anywhere inside our docs):/andWe should add some more detail to our docs for these two things:
and/or/not)