How to search Json message in Kibana elasticSearch

Question

I am using ElasticSearch Kibana dashboard with the following fields

host
_id
_score
index
message

of which message is a json string having values like

{"version": "3.4.2", "model": "EX2308", "orders": "50"}

I am searching for lucene query to search this JSON message having

orders > 30 and version > 3.4

Any help is appreciated

[Updated]

I am using logback-elasticsearch-appender to push messages into ElasticSearch using SLF4j

log.info(new org.json.JSONOject(arg).toString());

Solution

You can simply input the following Lucene query into the search field:

message.orders:>30 AND message.version:>3.4

Comments

[Achaius]

I am sorry, it is a JSON string stored as "{\"orders\": \"50\", \"version\": \"3.2.2\", \"model\": \"EU21x\"}"

[Val]

How do you ingest your documents? You should parse that JSON before indexing the documents into ES.

[Achaius]

Hey, I passed string to store using logStash. Kibana shows it as a JSON

[Val]

Update your question with your Logstash config

[Achaius]

Updated my question. Currently I don't have permission to see logstash config

[Achaius]

Thank you. I changed my log to store Parsed JSON string. Now the query you provided is working

[Val]

Awesome, glad you figured it out