To ease your experience in the Platform, we've created a standard in the search of the logs screen.
Check how to use the payload field and make
- simple searches;
- fuzzy searches;
- advanced searches.
In this field, you can use the simple query resource of “elasticsearch”, which allows searches to be made through the syntax of this type of filter. See the examples below:
denies an unique token
involves a series of token to give meaning to a search sentence
by the end of a term, it means a prefix query
after a word, it means editing distance (imprecision)
after a sentence, it means the amount of distance of these words in the sentence
The standard operator of the payload field is operator "AND". Therefore, by making a simples search, with the searched words separated by space, the query looks like this:
test xpto url
The filter will be interpreted the following way:
test AND xpto AND url
If you want to search the exact word, just put it between quotation marks ("").
In this case, the filter searches the specific word.
If you want to search a result from a partial word, just add the asterisk (*):
In the example above, the search will bring as result any word that starts with the requested prefix.
IMPORTANT: it's not possible to search partial words in the middle of the word due to the fields indexing.
An edit distance is the number of one-character changes needed to turn one term into another. These changes can include:
- Changing a character (box → fox) ~1
- Removing a character (black → lack) ~1
- Inserting a character (sic → sick) ~1
- Transposing two adjacent characters (act → cat) ~1
To find similar terms, the fuzzy search creates a set of all possible variations or expansions of the search term within a specified edit distance. The query then returns exact matches for each expansion.
Let's say you have these 3 registers:
Register 1: Andrew Joe Clinton
Register 2: Andrew Joe X. Clinton
Register 3: Andrew Joe X. JJ Clinton
And that you make the search in the following way:
The only returned register will be Register 1, because between “Joe” and “Clinton” you asked for up to ONE (~1) modification.
If you change your search to
the returned registers will be Register 1 and Register 2, because between “Joe” and “Clinton” you asked for up to TWO (~2) modifications.
The fuzzy search can also be used according to the description:
So, only close words with only ONE modification (~1) will be found.
CAT, CAB, TAC, ACT, ….
You can combine many operators in the search.
xpto +(test | prod) -data
The query will be interpreted the following way:
xpto AND (test OR prod) AND DOES NOT CONTAIN data
As previously mentioned, the standard operator of the search field is the operator "AND":
(url xpto) (test | flow)
Therefore, the search will be interpreted like this:
(url AND xpto) AND (test OR flow)