About Lucene query syntax

Why should we introduce Lucene: When we search for related logs in elk, the search language needs to follow Lucene to match the required information.

What is Lucene : Lucene is a set of open source libraries for full-text search and search, supported and provided by the Apache Software Foundation

Reference :

Https://lucene.apache.org/core/2_9_4/queryparsersyntax.html#NOT

Http://www.lucenetutorial.com/lucene-query-syntax.html

1 Full Text Search ( There are spaces must be enclosed in double quotation marks )

Example search for strings containing myname

"My name" because there are spaces in the middle, all need to enclose in double quotation marks.

2 Field Search
You can search by fields displayed on the left side of the page
Qualifying fields Full-text search: Field:value
Exact search: Keyword plus double quote filed: "Value"
http.code:404 searching for a document with an HTTP status code of 404
Whether the field itself exists
_exists_:http: HTTP fields are required in the returned results
_missing_:http: cannot contain HTTP fields

Example:
A. Search for DomainName for search.s.xxx.com
Domainname:search.s.d.xxx.com
Wording or
DomainName: "Search.s.d.xxx.com"

B. Search with a status of 400 or 200
status:404

C. Range values are
status:[400 to 499]

With the operational public
Status:500 and remote_addr:x.x.x.x
Or
status:500 and REMOTE_ADDR: "x.x.x.x"

status:200 andremote_addr:x.x.x.x

Non-and with
(Not status:200) and remote_addr:x.x.x.x

Matches a non-status of 200 remote_add is x.x.x.x
status:502 and Domainname:www.XXX.com

' PNG ' not ' a.xxx.com ' not ' =png '

3 wildcard characters
？ Match a single character
* ANY
+ >=0
? * cannot be used as the first character, for example:? text *text

4 Logical Operations
and
OR
+: This item must be included in the search results
-: cannot contain this item
+apache-jakarta test: Apache must be present in the results, cannot have jakarta,test dispensable
Group
(Jakarta OR Apache) and Jakarta
Field grouping
Title: (+return +"pink panther")
Escape special Characters
+-&& | | ! () {} [] ^" ~ * ? : \
The above characters need to be escaped as a value search

lunces Grammar : do not match v2 string
DomainName: "B.xxx.com" And-request: "V2"
–
The "-" operator or the prohibit operator excludes the text that contains the similarity after

About Lucene query syntax