- Published
- Author
- Ashwani Kumar JhaSenior System Analyst
Filtering API logs with path params in OpenSearch
When querying logs in OpenSearch Dashboards, paths with dynamic segments (like IDs) often don’t match with the usual search bar syntax because the field is mapped as
Problem:
• Queries like
return no results.
•
Solution:
Use Query DSL with a
✅ Wildcard query (matches any value in the middle):
✅ Regex query (restricts the middle part to numbers):
#opensearch #logs
When querying logs in OpenSearch Dashboards, paths with dynamic segments (like IDs) often don’t match with the usual search bar syntax because the field is mapped as
text instead of keyword.Problem:
• Queries like
Code
json.req.url: "/api/bankAccounts/*/debit"return no results.
•
.keyword may not exist (json.req.url.keyword) if the field wasn’t mapped that way at ingestion.Solution:
Use Query DSL with a
wildcard or regexp query.✅ Wildcard query (matches any value in the middle):
Code
{
"query": {
"wildcard": {
"json.req.url": {
"value": "/api/bankAccounts*/debit"
}
}
}
}✅ Regex query (restricts the middle part to numbers):
Code
{
"query": {
"regexp": {
"json.req.url": "/api/bankAccounts/[0-9]+/debit"
}
}
}#opensearch #logs