9

In Kibana chart I want to filter all urls that start with string CANCELLED so I wrote a regex: ^CANCELLED.* but when I use filter in Discover tab then I notice that filter doesn't work properly because it also accepts urls with phrase CANCELLED inside of an url.

Is it because Kibana regex uses other character than caret for the beginning of a string?

Michael Dz
  • 3,655
  • 8
  • 40
  • 74

1 Answers1

8

Instead of filters you should use the search textfield at the top of the webpage because filters don't fully support regex, after a chart is saved search queries will be also saved. As the wildcard use * instead of .*. That's how your search query should look like:

url.keyword:CANCELLED*
BStrach
  • 106
  • 1
  • 5