Foward slash in kibana 3 query

Posted by G Mawr on Server Fault See other posts from Server Fault or by G Mawr
Published on 2013-10-16T16:02:51Z Indexed on 2013/10/17 16:04 UTC
Read the original article Hit count: 364

I'm trying to add a query that will match a request that ends with a slash, like this one:

n.n.n.n - - [16/Oct/2013:16:40:41 +0100] "GET / HTTP/1.1" 200 25058 "-" "Mozilla/5.0 (iPad; CPU OS 7_0_2 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A501 Safari/9537.53"

I'm using the Lucene query type.

If my query is set to *, I see the event.

If I set it to request:"css", I see CSS requests, as expected.

However, all of the following yield no results:

  • request:"/"
  • request:"\/"
  • request:"\\/"

I tried a Lucene regular expression, with no luck:

  • request:/\//

I note that someone else is getting what appears to be a similar issue, although that's on Kibana 2: https://github.com/rashidkpc/Kibana/issues/401

How can I query for requests that end with a / character?

© Server Fault or respective owner

Related posts about apache2

Related posts about elastic-search