搜索Kibana搜索栏中的特殊字符

Question

我有用于日志分析的ELK 5.2.1。现在我需要通过Kibana搜索栏搜索一些字符串。例如，我需要找到包含“usage：527”的日志。我明白语法应该遵循https://lucene.apache.org/core/2_9_4/queryparsersyntax.html。但它不适合我。 我试过了：

"usage\:527" 
"usage:527" 
"usage?527" 
message:/usage\:527/ 
message:/.*usage:527.*/ 

但是没有成功。任何人都可以有经验帮助我吗？谢谢！

我知道使用开发工具来查询是另一种方式，但我的一些ELK用户不具备这些功能。

这是该指数的细节：

curl -XGET -u elastic localhost:9200/app_web_log-20170410 
Enter host password for user 'elastic': 
{"app_web_log-20170410":{"aliases":{},"mappings":{"log":{"properties":{"@timestamp":{"type":"date"},"@version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"beat":{"properties":{"hostname":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"name":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"deployment":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"input_type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"message":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"module":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"offset":{"type":"long"},"source":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}},"settings":{"index":{"creation_date":"1491782403146","number_of_shards":"5","number_of_replicas":"1","uuid":"73cWj5AHTmeFdXnJk4xCjQ","version":{"created":"5020199"},"provided_name":"app_web_log-20170410"}}}} 

Answer 1

根据你的映射，你可以尝试在Kibana下面的查询，如果该消息字段包含精确值usage:527：

message.keyword:"usage:527" 

如果usage:527是你的消息字段的子字符串，那么你可以尝试一个regular expression，像这样

message.keyword:/usage:527/