First of all, start here.
Kibana:
error
Query:
GET logstash-*/_search { "query": { "bool": { "must": [ { "multi_match": { "query": "error" } } ] } } }
Task: Try to search for “media”. Then search for “medi”. What does this tell us?
Kibana:
@tags: error
Query:
GET logstash-*/_search { "query": { "bool": { "must": [ { "match": { "@tags": "error" } } ] } } }
Kibana:
@tags: error && machine.os: ios
Query:
GET logstash-*/_search { "query": { "bool": { "must": [ { "match":{ "@tags": "error" } }, { "match": { "machine.os": "ios" } } ] } } }
Kibana:
@tags: error && -machine.os: ios
Query:
GET logstash-*/_search { "query": { "bool": { "must": [ { "match":{ "@tags": "error" } } ], "must_not": [ { "match": { "machine.os": "ios" } } ] } } }
If you get stuck and can’t figure out how to convert the Lucene syntax used in Kibana to the json syntax of the REST api, you can cheat like this:
Kibana:
@tags: error && (machine.os: ios || machine.os: "osx")
Query:
GET logstash-*/_search { "query": { "bool": { "must": [ { "query_string" : {"query":"@tags: error && (machine.os: ios || machine.os: \"osx\")"} } ] } } }