For more complicated queries, you need to be able to combine many different search functions together. You can do this with compound search functions in Elasticsearch. In this hands-on lab, you will leverage compound search functions and boolean logic to write and combine term-level and full-text queries into a single search request.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Craft a Query That Answers the Question: How Many Web Requests Originate from Either US or CN Where the Response Was Not 200?
From the Kibana console, craft a compound query on the
logsdataset that answers the question.- Craft a Query That Answers the Question: How Many Web Requests with a 200 Response and at Least 2 Tags with ‘success’, ‘security’, or ‘info’ Value Are Not from a Machine with a Windows Operating System?
From the Kibana console, craft a compound query on the
logsdataset that answers the question.- Craft a Query That Answers the Question: How Many Web Requests Were Made for apm-server RPM or DEB Files by Users Using an OS X Operating System?
From the Kibana console, craft a compound query on the
logsdataset that answers the question. Filter down the results to only include files between1024and8192bytes without effecting relevancy scoring.
