如何使用Kibana和ElasticSearch过滤掉空白邮件？

Question

According to Kibana, there are many log messages where the message is " " (2 blank spaces).

How to filter these out?

I tried matching " ", exists and regex with \\s, but those don't seem to work.

EDIT:

It seems my question was not clear. I created filters matching " ", exists and regex, but they did not work.

Here is the JSON. There are 2 spaces between the quotes. "message": " ",

Answer 1

Trying using filter to filter out the blank messages

Answer 2

As discussed in the comments, the analyzer is the issue. If you use the .keyword field, which isn't analyzed and gets created by default for text fields, you won't have that problem.

Example with the Lucene query syntax:

Example with Kibana's new query language (for this usecase they are the same):