[docs] Add KQL docs for combining wildcards with special characters & keywords #161377
Labels
docs
Feature:KQL
KQL
Icebox
impact:low
Addressing this issue will have a low level of impact on the quality/strength of our product.
loe:small
Small Level of Effort
Team:DataDiscovery
Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL.
A request recently came up regarding querying documents with special characters and wildcards.
For example, given the following documents:
"How do I filter for documents where the stuff inside the forward slashes does not start with a dot?"
They had tried several combinations of things with the wildcard inside of quotes, which doesn't work (we should make this explicit inside the docs). The answer ultimately came down to a combination of escaping special characters and wildcards:
span.name: Elasticsearch\: POST /*/_search AND NOT Elasticsearch\: POST /.*/_search
The follow-up question then was "What if the value contained
and
oror
?" And the answer is to also escape keywords (which I don't think we have anywhere inside our docs):/and
We should add some more detail to our docs for these two things:
and
/or
/not
)The text was updated successfully, but these errors were encountered: