Lucene query syntax used by Elk:kibana

Kibana in the Elk Camp to query the display data
Elasticsearch is built on Lucene and filter syntax is the same as Lucene

KIBANA4 Official Demo page full text Search

Enter login in the search bar to return the document containing login in all field values

Use double quotes to wrap up as a phrase search
"Like Gecko" field

You can also search by fields displayed on the left side of the page
Qualifying fields Full-text search: Field:value
Exact search: Keyword plus double quote filed: "Value"
http.code:404 searching for a document with an HTTP status code of 404

Whether the field itself exists
_exists_:http: HTTP fields are required in the returned results
_missing_:http: cannot contain HTTP field wildcard characters

? Match a single character
* Match 0 to more characters

Kiba?a, El*search

? * cannot be used as the first character, for example:? text *text regular

ES supports part of the regular function
mesg:/mes{2}ages?/ Fuzzy Search

~: Add ~ after a word to enable fuzzy search

First~ can also be matched to Frist

You can also specify how many degrees of similarity are required
cromm~0.3 will match to from and Chrome
Numeric range 0.0 to 1.0, default 0.5, the larger the closer the search is to the original value of the approximate search

Add ~ after the phrase
"Select where" to indicate that select and where are within 3 words in the middle of the search

Fields of numeric and time types can be queried for a range
LENGTH:[100 to 200]
date:{"now-6h" to "Now"}
[] indicates that the endpoint value is contained within the range, and {} indicates that the endpoint value is not included in the range logical Operation

and
OR

+: This item must be included in the search results
-: cannot contain this item
+apache-jakarta test: Apache must be present in the results, cannot have jakarta,test optional grouping

(Jakarta OR Apache) and Jakarta Field grouping

Title: (+return + "Pink Panther") Escape special characters

+-&& | | ! () {} [] ^" ~ * ? : \

The above characters need to be escaped as a value search

Reference links
Https://lucene.apache.org/core/5_2_0/queryparser/org/apache/lucene/que ...
Http://kibana.logstash.es/content/elasticsearch/api/search.html