Search code examples
elasticsearchkibanaelastic-stackkibana-5

Kibana query exact match of entire value


I have a series of records with a field App Version that currently has two possible values: 2.3.0 and 2.3.0 SP1. If I try to do a query for just 2.3.0 in the Dev Console like so...

GET myindex/_search
{
  "query": {
    "match": {
      "App Version": "2.3.0"
      }
  }
}

It returns all records, both ones with 2.3.0 SP1 and ones with 2.3.0. Since my ultimate goal is to delete all records with just App Version=2.3.0, I need some way to filter out the ones that include SP1. I can't find documentation anywhere that forces an exact match of the entire string, rather than just part of the string. Any ideas?

Edit: I'm running Kibana 5.2.2 if that helps.


Solution

  • For the exact match you should use a term query on a non-analyzed field (ES 2.X) or on keyword field (ES 5.X). But I suppose you will have to change the mapping.

    I alternative you can combine two or more queries in a bool query:

    {
      "query": {
        "bool": {
           "must": [
              {
                "match": {
                  "App Version": "2.3.0"
                }
              }
           ],
           "must_not": [
              {
                "match": {
                  "App Version": "SP1"
                }
              }
           ]
        }
      }
    }