Issue with query search containing forward slashes

[dylanzr]

We are running into an issue matching forward slashes in kibana searches. For instance, if I search for the term "message:5/47" no results are returned. Per #2980 I know this is due to the change in Elasticsearch syntax with Lucene4. However, "5/47" nor "5/47" return results.

However, querying ES directly with the following works as expected:

curl -X GET "http://localhost:9200/logstash-2013.09.12/_search?from=0&size=1&pretty" -d '{
  "query": {
    "query_string": {
      "query": "message:5\\/47 AND path:uas02"
    }
  }
}'

Is this a bug or am I doing something wrong?

[dylanzr]

Actually, now that I don't erroneously quote my search it will process. Looking at the output from the events table I have modified my query. It looks like:

curl -X GET "http://localhost:9200/logstash-2013.09.12/_search?from=0&size=1&pretty" -d '{
 "query": {
    "filtered": {
      "query": {
        "bool": {
          "should": [
            {
              "query_string": {
                "query": "message:5\\/47"
              }
            }
          ]
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "match_all": {}
            },
            {
              "bool": {
                "must": [
                  {
                    "match_all": {}
                  }
                ]
              }
            }
          ]
        }
      }
    }
  }
}'

I will investigate why the results are different from this query compared to what I expect from the above.