I’m using OpenSearch Dashboard to look for specific logs. I need to filter them using query DSL to get following results:
“sText”: “.*task started” OR “sText”:”.*task finished”
I am able to filter using “query regexp” for one value
{
"query": {
"regexp":{
"sText":".*task finished"
}
}
}
or for one of the 2 specific values using “should” :
{
"query": {
"bool":{
"should":[
{
"match":{
"sText":"XYDB task finished"
}
},
{
"match":{
"sText": "XYDB task started"
}
}
]
}
}
}
How do I combine these so I can use the regexp inside the “should” query?
I tried:
{
"query": {
"bool": {
"should": [
{
"match": {
"regexp":{
"sText": ".*task started"
}
}
},
{
"match": {
"regexp":{
"sText": ".*task finished"
}
}
}
]
}
}
}
and also:
{
"query": {
"regexp":
"bool": {
"should": [
{
"match": {
{
"sTask": ".*task started"
}
},
{
"match": {
"sTask": ".*task finished"
}
}
]
}
}
}
}
I also tried to use “wildcards” instead of “regexp” but the results were the same.
Dominika Talianova is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
So I found an answer to this after all.
The problem was I was using “match” in combination with “regexp” but the “regexp” should be used INSTEAD of “match” as it looks for exact matches.
The filter should look like:
{
"query": {
"bool": {
"should": [
{
"regexp":{
"sText": ".*task started"
}
},
{
"regexp":{
"sText": ".*task finished"
}
}
]
}
}
}
Dominika Talianova is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.