KQL: filter by field value

Kibana Query Language — filter logs by field values

status: 404 AND method: GET
tool
kibana15 commands
tags
kibana

More kibana commands

  • KQL: range query
    response_time > 500 AND @timestamp > now-1h

    Filter events in the last hour with slow responses

  • KQL: wildcard search
    message: *OOMKilled*

    Wildcard match in a field value

  • KQL: nested field filter
    kubernetes.pod.name: web-* AND kubernetes.namespace: prod

    Filter by nested Kubernetes metadata fields

  • Create index pattern via API
    curl -X POST http://kibana:5601/api/saved_objects/index-pattern -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{"attributes":{"title":"logs-*","timeFieldName":"@timestamp"}}'

    Register a new index pattern via Kibana REST API

  • Export saved objects
    curl -X POST http://kibana:5601/api/saved_objects/_export -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{"type":["dashboard","visualization"],"includeReferencesDeep":true}' -o export.ndjson

    Export dashboards and visualizations to NDJSON

all 15 kibana commands