ES (two): Kibana

bana is a front-end presentation tool based Elasticsearch browser page. Kibana all use language HTML and Javascript written query syntax is based on Lucene query syntax. Allowing Boolean operators, wildcards, and field screening. Note keywords to uppercase

research all

---

• In the search field, enter login, all field values ​​will return to the document contained in the login
• Use double quotes to wrap as a search phrase "like Gecko"

Search field: You can also search by field on the left side of the page display

---

• Limited full-text search field: field: value
• Refine search: Keyword double quotes filed: "value"
• http.code: 404 search http status code of 404 documents
• Whether the field itself exists

1. 1. _exists_: http: http returns the result in the need for field
   2. _missing_: http: http field can not contain

Wildcards

---

• ? Matches any single character
• * Matches zero or more characters
• ? * Can not be used as the first character, for example:? Text * text

Fuzzy search

---

• ~: In a word back together - to enable fuzzy search, first ~ can be matched to the frist
• Similarity can also specify how many needs, such as: cromm ~ 0.3 and matches the chrome from
• Value range of 0.0 to 1.0, 0.5 default, the greater the closer to the original value of the search

Proximity search

---

• - adding after the phrase, such as: "select where" ~ 3 represents select intermediate therebetween, and where less than three words

Range Search

---

• Time values ​​and types of fields can be queried for a certain range, such as:

1. 1. length:[100 TO 200]
   2. date:{"now-6h" TO "now"}
   3. [] Represents the value contained in the range of endpoints, endpoints {} indicates the value is not included within the scope of

Logical operation

---

• Boolean operators (AND, OR, NOT), operators AND / OR / NOT must be capitalized
• +: This must be included in the search results
• -: You can not contain this
• + Apache -jakarta test: the results must exist apache, you can not have jakarta, test dispensable

Packet

---

• 如：(jakarta OR apache) AND jakarta
• Field of the packet: title: (+ return + "pink panther")

Escape special characters

---

•  + - && || () {} [] ^ "~ *:!? \ Character as a value above the search when the need to use \ to escape