Filter your documents

Prerequisites #

You need an Elasticsearch cluster with a Kibana instance connected to it. If that is not yet the case, we invite you to complete the lab on installing Elasticsearch.

Lucene #

1. Search language

   In the 'Discover' application, how do you change the language used to filter results? What is the default language?

2. My first filter

   In the 'mon-premier-index' index, display all documents whose message contains the word 'bulk'

3. My second filter

   In the 'mon-premier-index' index, display all documents whose message contains exactly 'mon bulk', with an id between 2 and 4 and with an 'office' value of 'RousselTM' or 'Elastic'

4. Did you notice?

   By default, Elasticsearch interpreted all of our JSON. In this exercise, let us assume we want it to keep the whole content of 'user' in the same field. What mapping would be needed for that? We will therefore create a new index named 'mon-second-index' with this mapping and re-import our bulk data to see the difference.

5. Searching a 'nested' field

   Run the same search as before, but on 'mon-second-index'

Kibana Query Language #

1. Good to know

   Everything you could do with Lucene filters is possible with KQL, and much more.

2. My first filter

   In the 'mon-second-index' index, display all documents whose 'user.number' is greater than or equal to 2825

3. Operations

   In the 'mon-second-index' index, display the average of 'user.number'

Difficulty level : ●●●○○ (3/5)