https://docs.logz.io/assets/js/16feac8a.2fc1233f.js

1"use strict";(self.webpackChunkmy_website=self.webpackChunkmy_website||[]).push([[7736],{3905:(e,t,a)=>{a.d(t,{Zo:()=>c,kt:()=>h});var n=a(67294);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function o(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?o(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):o(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function s(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},o=Object.keys(e);for(n=0;n<o.length;n++)a=o[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)a=o[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var l=n.createContext({}),d=function(e){var t=n.useContext(l),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},c=function(e){var t=d(e.components);return n.createElement(l.Provider,{value:t},e.children)},p="mdxType",u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},g=n.forwardRef((function(e,t){var a=e.components,r=e.mdxType,o=e.originalType,l=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=d(a),g=r,h=p["".concat(l,".").concat(g)]||p[g]||u[g]||o;return a?n.createElement(h,i(i({ref:t},c),{},{components:a})):n.createElement(h,i({ref:t},c))}));function h(e,t){var a=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=a.length,i=new Array(o);i[0]=g;var s={};for(var l in t)hasOwnProperty.call(t,l)&&(s[l]=t[l]);s.originalType=e,s[p]="string"==typeof e?e:r,i[1]=s;for(var d=2;d<o;d++)i[d]=a[d];return n.createElement.apply(null,i)}return n.createElement.apply(null,a)}g.displayName="MDXCreateElement"},43977:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>l,contentTitle:()=>i,default:()=>u,frontMatter:()=>o,metadata:()=>s,toc:()=>d});var n=a(87462),r=(a(67294),a(3905));const o={sidebar_position:5,title:"Wildcard Searches",description:"How to use Wildcards in Logz.io",image:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg",ke

1ywords:["logz.io","wildcards","searching logs","log analysis","observability"]},i=void 0,s={unversionedId:"user-guide/log-management/opensearch-dashboards/opensearch-wildcards",id:"user-guide/log-management/opensearch-dashboards/opensearch-wildcards",title:"Wildcard Searches",description:"How to use Wildcards in Logz.io",source:"@site/docs/user-guide/log-management/opensearch-dashboards/opensearch-wildcards.md",sourceDirName:"user-guide/log-management/opensearch-dashboards",slug:"/user-guide/log-management/opensearch-dashboards/opensearch-wildcards",permalink:"/docs/user-guide/log-management/opensearch-dashboards/opensearch-wildcards",draft:!1,editUrl:"https://github.com/logzio/documentation/tree/master/docs/user-guide/log-management/opensearch-dashboards/opensearch-wildcards.md",tags:[],version:"current",sidebarPosition:5,frontMatter:{sidebar_position:5,title:"Wildcard Searches",description:"How to use Wildcards in Logz.io",image:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg",keywords:["logz.io","wildcards","searching logs","log analysis","observability"]},sidebar:"tutorialSidebar",previous:{title:"Understanding Log Patterns",permalink:"/docs/user-guide/log-management/opensearch-dashboards/opensearch-patterns"},next:{title:"Troubleshooting Logs and OpenSearch Dashboards",permalink:"/docs/category/troubleshooting-logs-and-opensearch-dashboards"}},l={},d=[{value:"Enable and disable Wildcards",id:"enable-and-disable-wildcards",level:2},{value:"Wildcards' alternatives",id:"wildcards-alternatives",level:2},{value:"Change the field mapping to an analyzed field",id:"change-the-field-mapping-to-an-analyzed-field",level:4},{value:"Analyzed text fields tokenize strings",id:"analyzed-text-fields-tokenize-strings",level:4},{value:"Contact support to request a custom configuration",id:"contact-support-to-request-a-custom-configuration",level:6}],c={toc:d},p="wrapper";

1function u(e){let{components:t,...a}=e;return(0,r.kt)(p,(0,n.Z)({},c,a,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"Wildcards can be useful when you need to run a search on an indefinite term or a partial string."),(0,r.kt)("p",null,"When using the Lucene query syntax in OpenSearch Dashboards:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Use a question mark ",(0,r.kt)("strong",{parentName:"li"},(0,r.kt)("i",{class:"fas fa-question"}))," to replace a single character. It's like a Joker in a card game."),(0,r.kt)("li",{parentName:"ul"},"Use an asterisk ",(0,r.kt)("strong",{parentName:"li"},(0,r.kt)("i",{class:"fas fa-asterisk"}))," to replace an indefinite number of characters (even 0).")),(0,r.kt)("h2",{id:"enable-and-disable-wildcards"},"Enable and disable Wildcards"),(0,r.kt)("p",null,"Wildcard searches can be very resource heavy and slow to run."),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Leading wildcards are disabled")," to prevent potential issues. In other words, your searches cannot begin with a wildcard."),(0,r.kt)("p",null,"For example, you can run a free text search for ",(0,r.kt)("inlineCode",{parentName:"p"},"string")," but not for ",(0,r.kt)("inlineCode",{parentName:"p"},"*string"),". Similarly, you can run a search for a ",(0,r.kt)("inlineCode",{parentName:"p"},"field:value")," pair, such as ",(0,r.kt)("inlineCode",{parentName:"p"},"key:string")," but not ",(0,r.kt)("inlineCode",{parentName:"p"},"key:*string"),"."),(0,r.kt)("h2",{id:"wildcards-alternatives"},"Wildcards' alternatives"),(0,r.kt)("h4",{id:"change-the-field-mapping-to-an-analyzed-field"},"Change the field mapping to an analyzed field"),(0,r.kt)("p",null,"If you want to search by partial field content, you have the option to change the field mapping to ",(0,r.kt)("strong",{parentName:"p"},"analyzed text"),"."),(0,r.kt)("p",null,"Analyzed fields support filtering for a value that contains a certain string and can replace the need for leading wildcards."),(0,r.kt)("p",null,"For example, say you are looking for a particular host, instead of searching with a leading wildcard for ",(0,r.kt)("inlineCode",{parentName:"p"},"host:*prod*"),", you can use the filters to filter under the field ",(0,r.kt)("inlineCode",{parentName:"p"},"host")," for a value that contains ",(0,r.kt)("inlineCode",{parentName:"p"},"prod"),"."),(0,r.kt)("h4",{id:"analyzed-text-fields-tokenize-strings"},"Analyzed text fields tokenize strings"),(0,r.kt)("p",null,"Analyzed text fields tokenize longer strings to support full-text search on individual terms."),(0,r.kt)("p",null,"Tokenization can mean indexing the words in a sentence, or breaking up a complex naming structure into stand-alone naming components to support more robust filtering options."),(0,r.kt)("p",null,"The tokenizing processor can use different predefined characters as delimiters to cut up the string into shorter terms. These can be spaces, periods, slashes, underscores, etc."),(0,r.kt)("p",null,"To change a field mapping,\nselect ",(0,r.kt)("a",{parentName:"p",href:"https://app.logz.io/#/dashboard/tools/field-mapping"},"Data Hub > Field mappings"),"\nfrom the navigation menu. Search for the field name, hover over it, and select the ",(0,r.kt)("strong",{parentName:"p"},"analyzed")," mapping option. The field will be explicitly mapped."),(0,r.kt)("p",null,(0,r.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/kibana-mapping/kibana-field-mapping_aug2021.png",alt:"Explicit field mapping in Logz.io"})),(0,r.kt)("h6",{id:"contact-support-to-request-a-custom-configuration"},"Contact support to request a custom configuration"),(0,r.kt)("p",null,"If the above solutions do not satisfy your needs, please ",(0,r.kt)("a",{parentName:"p",href:"mailto:[email protected]?subject=Requesting%20alternatives%20to%20wildcard%20searches&body=Hi!%20Please%20be%20in%20touch%20regarding%20search%20methods%20that%20don't%20require%20leading%20wildcards.%20Thanks!"},"contact support")," to request a customized solution."))}u.isMDXComponent=!0}}]);