Performing Queries with Kibana

04Jan 2018 by Ruben Canton

Queries

To get anything in the index:

GET /_search
{"query": {"match_all": {}}}

To get a document type inside the index (dragon-dev is the index name):

GET dragon-dev/organisation/_search
{"query": {"match_all": {}}}

GET dragon-dev/article/_search
{"query": {"match_all": {}}}

GET dragon-dev/person/_search
{"query": {"match_all": {}}}

Search by Guid (two different ways):

GET dragon-dev/person/_search
{
  "query": {
    "match": {
      "id": "8dd0f391-ce67-41e6-bf68-374716a90bfe"
    }
  }
}

GET dragon-dev/associate/_search
{
  "query": {
    "match": {"associatedWithId": "dbc8814d-9123-47d3-8dac-e31a7de5107e"
    }
  }
}

Sorting

// Sorting by a numeric or Date field is straight forward
GET dragon-dev/organisation/_search
{
"sort": [{"websiteId": {"order" : "asc"}}],
"query": {"match_all": {}}
}

// But a text field requires to make it a keyword type and search by keyword:
GET dragon-dev/organisation/_search
{
"sort": [{"name.keyword": {"order" : "asc"}}],
"query": {"match_all": {}}
}

Deleting documents using Kibana

To delete the entire index just request this by URL:

DELETE index-name/

To delete a document or a group of them, you can perform a query changing the “_search” command for a “_delete_by_query” one:

// So instead of this:
GET index-name/eventArticle/_search/
{
  "query": {
    "match": {
      "longHeadlines": "Hello world"
      }
  }
}

// You request this:
GET index-name/eventArticle/_delete_by_query/
{
  "query": {
    "match": {
      "longHeadlines": "Hello world"
      }
  }
}