Is "logstash-" a mandatory prefix of indices in kibana? - indexing

If I put messages on index "[logstash-example-]YYYY.MM.DD" then kibana can show the log message in charts but if it's on "[example-]YYYY.MM.DD" then it won't find it.
(curl query gives back the correct result in latter case)
According to documentation it should work:
"For example [web-]YYYY.MM.DD,[mail-]YYYY.MM.DD Please also note that indices should rollover at midnight UTC."
(Elasticsearch 1.3.4, Kibana 3.1.0)

You have to modify your kibana dashboard setting
Click Configure dashboarad in Kibana on Right Top.
Select Index tab.
Modify Index pattern to your new index pattern. For example: [example-]YYYY.MM.DD
Hope this can help you.

Related

GraphDB Lucene index - how to exclude property URIs from search results?

It seems that by default a Lucene index that indexes "uris" will index both nodes and properties. How can properties be excluded from search results?
The documentation shows a setting:
luc:exclude luc:setParam "bnode".
However its only valid values are "literal", "bnode", and "uri". How can property URIs be excluded? (they are not something that a search would be interested in).
I assume that you're using https://graphdb.ontotext.com/documentation/standard/full-text-search.html and not https://graphdb.ontotext.com/documentation/standard/lucene-graphdb-connector.html ?
The doc doesn't show what you show above, but shows
luc:exclude luc:setParam "hello.*"
which means "exclude strings that match the regex".
Which things to index is controlled by
luc:include luc:setParam "literal" # literal, uri, centre
If I understand correctly, you want to index URIs of nodes, but not URIs of outgoing properties? Then the answer would depend on the kind of molecule you are traversing.
luc:include luc:setParam "literal centre" will index only the central node URIs, which is probably what you want
with luc:excludePredicates you can list all properties you want to exclude, but that will also cut out the nodes that they reach...

How to include the query filter in URL (cloudSearch)

I am trying to retrieve data from cloudSearch, searching for the word "Person" and adding the following filter:
(prefix field=claimedgalleryid '')
The problem is that I don't know how to create the URL using that exact filter.
Could someone give me a suggestion or some link to Amazon documentation related to this topic?
What I've tried and didn't work:
...search?q=Gallerist&size=10&start=0&fq=(prefix%20field=claimedgalleryid%20%27%27)
...search?q=Gallerist&size=10&start=0&filter=(prefix%20field=claimedgalleryid%20%27%27)
You were close with your first attempt--it looks like you forgot to URI encode the = sign as %3D. Try this instead:
&fq=(prefix+field%3Dclaimedgalleryid+'')
I highly recommend using the "test search" feature to work out the kinks in your query syntax. You can see the results right there, and then use the "View Raw: JSON" link to copy the full request URL and see how characters get escaped and such.

How to adjust Kibana Dashboard link in ElastAlert

I have written the following rule
type: frequency
filter:
- query:
query_string:
query: "category:foo.bar AND msg._:*Failure*"
alert_text: "Total number of errors cross threshold..... <a href='{0}'>Kibana link</a>"
alert_text_args:
- kibana_link
alert_text_type: alert_text_only
my config.yaml is
# Kibana Dashboard
use_kibana4_dashboard: http://mykibana.com/
When an alert is raised and I click on the hyperlink which I am putting in the message. It takes me to my dashboard.
But what I want is that instead of a dashboard it takes to the data discovery screen and there it issues the very same query that it had issued when the alert was raised.
This way I want to see exactly the query results which the elastalert had seen when the alert was raised.
Actually, I was able to solve this myself. I am writing my solution here.
So basically, I did the exact same search as my criteria above in kibana and saved that search. Next I created a dashboard and pulled the saved query into the dashboard.
Next I pointed the rule to the new dashboard which contains the saved query.
When the link is generated, the elastalert will create the link in a way the time period is injected into the hyperlink. When you click on the link you will see exactly what the alert saw.

Aem fulltextsearch

I want to search for a exact combination of words in all nodes in the aem using query builder.
Trying to debug the query http://localhost:4502/libs/cq/search/content/querydebug.html it returns me results that doesn't match my query.
For example if want to search for 'foo bar' in all nodes and I need to receive all nodes that contain 'Foo Bar', 'foo Bar', 'Foo bar', 'FOO BAR' but not only 'foo' and only 'bar' and not 'foo-bar'. Query in service is done by using QueryBuilder.
QueryBuilder is useful when you try to perform a query similar to SQL where you search against a property and its value. The full text search capabilities of the query debug interface is very limited as you have experienced.
However, remember that AEM uses an underlying Lucene and/or Solr index and it does provide a way to perform a native solr / lucene query.
Firstly create a embedded solr index (embedded is sufficient for a local development AEM instance) as mentioned under "Configuring AEM with an embedded SOLR server" in https://docs.adobe.com/docs/en/aem/6-0/deploy/upgrade/queries-and-indexing.html. This will trigger solr indexing of your JCR content.
Once indexing is complete (as seen from logs), you can perform native queries using the crx/de query interface.
Example query: select [jcr:path] from [nt:base] where native('solr', '<filter>?<solr_query_goes_here>'. Quite obviously you need to be familiar with solr queries. Thanks to the following slide share (slide 50 talks about native queries within AEM) http://www.slideshare.net/justinedelson/demystifying-oak-search
AEM support for native solr queries is a bit patchy. You might need to edit the SOLR schema xml file manually (created under the crx-quickstart folder) to add additional filters, custom fields etc. We had successfully tuned solr within AEM to perform a spacial search using the above method.
If you need all sorts of combinations for "foo bar" then you have to query:
fulltext=foo bar
You will only get the first 10 results. To get all, you'll need to:
p.limit=-1
You may want to specify the path:
path=/content/website/
Visit Adobe Query Builder API for more info.
Behind the scenes, AEM creates an xpath query and then executes it. Then, for any part of the query that doesn't map to xpath, it runs through the results and filters them.
You should also think about if there is a property to match as opposed to any text. That will give you much better results since you want accuracy. Right now you are casting an overly wide net, and I think you should consider restricting if for nothing other than performance reasons. Just a suggestion.
You say the results don't match your query, can you give us some idea of what comes back? And can you please put your actual query here. That will make it much easier to help.
this is a minimal example that provides a full-text search:
Query query = queryBuilder.createQuery(...);
// limit path
Predicate path = new Predicate(PathPredicateEvaluator.PATH);
path.set(PathPredicateEvaluator.PATH, "/content/where/ever);
query.getPredicates().add(path);
// Fulltext
Predicate fulltextSearch = new Predicate(FulltextPredicateEvaluator.FULLTEXT);
fulltextSearch.set(FulltextPredicateEvaluator.FULLTEXT, "foo bar");
fulltextSearch.set(FulltextPredicateEvaluator.REL_PATH, "jcr:content");
query.getPredicates().add(fulltextSearch);
// can I haz excerpt?
query.setExcerpt(true);
// Paging?
query.setStart(...);
query.setHitsPerPage(-1);
Note: it's not required to configure a solr index or whatever, you should be fine out of the box.
But if you limit the search to specific fields, you should create an index entry in oak:index. You can find a great cheat-sheet here.
I'm not sure if this helps.
but to get all the combinations of nodes that have the text i'm looking for I use jcr:like in xpath.
for example if I want to search all the nodes which has any property with Foo bar in its value or key, then my query looks like:
/jcr:root/content/yourpath//*[jcr:like(\*/, '%FOO bar%')]
You will not get that flexibility in QueryBuilder but you can still get what you want by using JCR-SQL2.
The following query will return all entries with "Foo Bar", "foo bar", "foo Bar", "Foo bar", but not "foo", "bar", "foo-bar" when your value is "foo bar".
SELECT * FROM [nt:unstructured] WHERE ISDESCENDANTNODE('/jcr:root/content/yourpath') AND LOWER([prop]) LIKE "%foo bar%" ORDER BY [cq:lastModified] desc
Just ensure that while checking for the values in repository you send the value in lowercase for case-insensitive search.
For case-sensitive search you can use:
SELECT * FROM [nt:unstructured] WHERE ISDESCENDANTNODE('/jcr:root/content/yourpath') AND [prop] LIKE "%foo bar%" ORDER BY [cq:lastModified] desc

sharepoint crawl rule to exclude AllItems.aspx , but get an item/document in search resu lts if queried in the search box

I followed this blog Tips 1and created a crawl rule http://.*forms/allitems.aspx and ran full crawl. I no longer get the results with AllItems.aspx. However, if there is any document with name Something.doc in a Document Library , it no longer gets pulled in the search results.
I think what I desire is a basic functionality, like the user should not get to see Allitems.aspx in the search results but should get the item/document with names entered in the search box.
Please let me know if I am missing anything. I have already put in 24 hours...googled the max I could.
It seems that an Index Reset is required. Here's the steps I did:
1. Add the following crawl rule to exclude: *://*allitems.aspx.
2. Index Reset.
3. Full Crawl.
I could not find a good way to do this using crawl rules. Instead, I opted to set up a restriction on the search results web part.
In the search results web part properties, select "Change Query"
Add a property filter to exclude anything with "AllItems" (and any other exclusions you want in place.
Used Steve Mann's blog as a reference and for the images: http://stevemannspath.blogspot.com/2013/04/sharepoint-2013-search-removing-junk.html