We knew that in Kibana we could implement three types of search

1. See my previous article “Getting Started with Elasticsearch (2)” for more on DSL search
2. KQL Search, you can refer to my previous article “Kibana: How to Use the Search Bar”
3. Lucene Search. You can refer to my previous article “Kibana: How to Use the Search Bar.”

Of the three search methods, DSL and Lucene search can support fuzziness and wildcard queries. KQL is the default Search method for the Search Bar, but it does not support fuzzy queries. Today we are going to focus on how to implement fuzzy queries and wildcard queries through Lucene search. So how do we do Lucene queries?

By default, Kibana Query Language (KQL) is the default Search Language for the Search Bar. It has the advantage of automatic completion, such as:

To switch to Lucene search, we click on KQL above:

We click the switch above:

So our Search Bar Search becomes Lucene’s Search. In Lucene search mode, autoComplete is gone. We need to memorize the full search command.

 

To prepare data

In today’s exercise, we will show how to implement fuzzy queries as well as wildcard queries in the Search Bar. To do this, we create the following document:

PUT my_index/_doc/1
{
  "content": "I like the articles from liuxg"
}
Copy the code

Enter the above command in Kibana’s Console. So we create an index called my_index and it contains a document. If we wanted to implement this fuzzy query using a DSL, we could do this:

GET my_index/_search
{
  "query": {
    "match": {
      "content": {
        "query": "liuxo",
        "fuzziness": 1
      }
    }
  }
}
Copy the code

It says that if there is a spelling mistake, we can search the document as well. Of course, we can also set fuziness to 2, or auto, depending on your needs. If you want to learn more about fuzzy queries, see my article “Elasticsearch: Fuzzy Search”.

We can also implement wildcard searches:

GET my_index/_search { "query": { "wildcard": { "content": "liux?" }}}Copy the code

So how do we implement the same Search in the Search Bar? The answer is to use Lucene search.

 

Fuzzy Search and wildcard Search are realized in Search Bar

First, we must create an index pattern for my_index so that we can use it in Discover:

Click Create Index Pattern above. This creates the index schema for my_index.

We open Discover and load the my_index index schema. Let’s first switch to Lucene search mode:

 

Wildcard search

We can use the following method for wildcard search:

Here? Represents a character. This kind of search is not available in KQL. Of course, we can also conduct the following search:

We can also perform the following searches:

The * here means to match multiple characters. This approach is also supported in KQL.

 

Fuzzy query

We can do fuzzy queries in the following way. This is usually used when we don’t know exactly what words we are searching for, or because we have typed some words incorrectly:

The ~1 here means that one of the letters is allowed to be wrong. If you can allow two letter errors, you can use the following method:

Up here, we have two letters that are wrong, but we can still retrieve the results.

When we do not know exactly how many letters are wrong, we can use the following method:

We use ~auto for that. As shown above, when we use auto, we can’t search for results with two letters wrong. It’s up to Elasticsearch to decide whether to use 1 error or 2 errors. When the string length exceeds 5, fuziness is automatically set to 2. If the string length is less than 2, fuziness is automatically set to 0.

Let’s modify the search above and only get one letter wrong. Let’s use auto again:

From the above results, we can see that we can search for the results we want.