I need to use Kibana to search the logs of my container, whose name is ABCDE-prod
.
So in the KQL field I put
kubernetes.container.name.keyword is ABCDE-prod
But then Kibana treats the dash (-
) as a space, and so the query becomes the equivalent of
kubernetes.container.name.keyword is ABCDE
OR
kubernetes.container.name.keyword is prod
How can I tell KIbana to treat ABCDE-prod as a single string?
I tryed with
kubernetes.container.name.keyword is "ABCDE-prod"
but it returns this error log:
Error loading data
Expected ":", "<", "<=", ">", ">=", AND, OR, end of input, whitespace but """ found. kubernetes.container.name.keyword is "ABCDE-prod" -------------------------------------^
SOLVED!
kubernetes.container.name.keyword is ABCDE-prod
must not be put in the KQL field, but added as a filter, with the button just below the KQL field:
+add filter > filter widget:
select filter:
kubernetes.container.name.keyword
select operator:
is
select value:
ABCDE-prod
this automatically creates a filter that searches the logs of ABCDE-prod
.