How to tell Kibana to read a container name having dash inside as a single string

12/10/2020

I need to use Kibana to search the logs of my container, whose name is ABCDE-prod.

So in the KQL field I put

kubernetes.container.name.keyword is ABCDE-prod

But then Kibana treats the dash (-) as a space, and so the query becomes the equivalent of

kubernetes.container.name.keyword is ABCDE
OR
kubernetes.container.name.keyword is prod

How can I tell KIbana to treat ABCDE-prod as a single string?

I tryed with

kubernetes.container.name.keyword is "ABCDE-prod"

but it returns this error log:

Error loading data

Expected ":", "<", "<=", ">", ">=", AND, OR, end of input, whitespace but """ found. kubernetes.container.name.keyword is "ABCDE-prod" -------------------------------------^

-- Tms91
kibana
kubernetes

1 Answer

12/13/2020

SOLVED!

kubernetes.container.name.keyword is ABCDE-prod

must not be put in the KQL field, but added as a filter, with the button just below the KQL field:

+add filter > filter widget:

select filter: kubernetes.container.name.keyword

select operator: is

select value: ABCDE-prod

this automatically creates a filter that searches the logs of ABCDE-prod.

-- Tms91
Source: StackOverflow