I would like to search the entire record for a list of text strings using the IN function.
At the moment, I have a search that looks a bit like
(a OR b OR c) AND message_type=foo
zc etc. in the field
I would rather use something like
video_type IN (a, b, c) AND message_type=foo
_raw IN (a, b, c) AND message_type=foo
Because I want to use the search in a dashboard and have users paste
c in an input.
But free text search doesn't work if you specify a field to search in — it only seems to find exact matches.
As the search is used in dashboard, the user inputs can be collected in a token and run against search. Do you see any issues with that? you don't need to use IN
your base search messagetype=foo| search (videotype=$tokenA$ OR video_type=$tokenB$)