opensearch-project
[BUG] Impossible to use DQL Search query with $ inside
Describe the bug
A clear and concise description of what the bug is.
To Reproduce Steps to reproduce the behavior:
- Go to Discover
- Enter Search String like "winlog.event_data.TargetUserName: *$
Expected behavior Documents with parameter winlog.event_data.TargetUserName and value ending with $ (Computer Accouts) are filtered out
OpenSearch Version 2.11.1
Dashboards Version 2.11.1
Screenshots
If applicable, add screenshots to help explain your problem.
Host/Environment (please complete the following information):
- OS: Rocky linux 9.3
- Firefox 120.0.1
I also cannot escape the $
Add any other context about the problem here.
The DQL query under the hood is converted into a DSL request like below. Are you able to able to query using DSL the fields with $ in them?
{
"query": {
"bool": {
"must": [],
"filter": [
{
"multi_match": {
"type": "best_fields",
"query": "$",
"lenient": true
}
}
]
}
}
}
I try also with this. But it not works.
Should this line "query": "$"
Not be "query": "*$"
Von meinem iPhone gesendet
Am 29.12.2023 um 00:07 schrieb Ashwin P Chandran @.***>:
"query": "$"
Is there any further information i have to provide? With the proposed solution of @ashwin-pc i don't get any results.
Nope, thi was useful @markusg80. Adding more context here. To reproduce the issue with DQL search queries involving the $ character, follow these steps:
Open the Dashboards Console app and execute the following commands to create an index and ingest data:
PUT /test_index
{
"mappings": {
"properties": {
"winlog.event_data.TargetUserName": {
"type": "keyword"
}
}
}
}
POST /test_index/_bulk
{ "index": {} }
{ "winlog.event_data.TargetUserName": "user1$" }
{ "index": {} }
{ "winlog.event_data.TargetUserName": "user2" }
{ "index": {} }
{ "winlog.event_data.TargetUserName": "admin$" }
Go to the "Discover" tab and select the test_index index pattern.
Enter winlog.event_data.TargetUserName: *$ in the search bar and observe the results.
This should help reproduce the issue described.
So you are able to search with $ in te query bar. So it looks like there is some other issue here. Whats your original index mapping for the problematic index pattern?