I have an item to search withing logs with the schema similar to one below. It is kind of searching for certain uri and status within a dynamic list of items.. item_1, item_2, item_N
log": {
"type": "web""datetime": "xxxxx"
"data": {
"item_1": {
"httpstatus": "200",
"path": "/pr/s1"
},
"item_2": {
"httpstatus": "200",
"path": "/pr/s2"
}
}
}
I am kind of wondering how to make Item_* search with a regex. So , in this case it's the field name which would need regex. Any pointers on where to start
if the event you posted is json, then it should be parsed automatically.
do you want to extract item_1=value and item_2=value and so on?
so.. in query/search , the value of the item would be used as a parameter, and result shoud only show ones matching
say searching for a value within all item_*, ones that match should show up.