Basic field searches

This section explains how to use query syntax to construct basic search queries using Context Help mode, Default mode, and Expert mode.

Method 1: Automatic query construction

This query searches your session data and returns all documents that match a destinationTransportPort of 80. You use the automatic completion feature to create a Structured-Pill and construct the query.

In Context Sensitive Help mode:

Click inside the Query bar to display a list of field names.
Scroll down and select the destinationTransportPort: field.
Click in the box next to destinationTransportPort and enter 80.
Click the time picker and select the start and end time for your search.
Click the search icon in the Query bar to run the search.

In Default mode:

Click inside the Query bar to display a list of field names.
Scroll down and select the destinationTransportPort: field.
Type 80 immediately following the colon. Remove any spaces between the fieldname and term and click Enter.
Click the time picker and select the start and end time for your search.
Click the search icon in the Query Bar to run the search.

Note
There is no automatic query construction in Expert mode.

Note
Always click Enter after typing your query to apply your query syntax, exceptions, or both to your search.
Spaces between the fieldname: and the term or value will return "No Data Available" or incorrect query results in the Event Table.

Method 2: Manual query construction

In Default mode:

You can manually create a Structured-Pill to contain your query syntax. The following query finds all documents with a doc_values_type of smtp:

Type DOC_VALUES_TYPE: followed by smtp in the Query Bar, and click Enter.
Use the time picker and select the start and end time.
Click the search icon in the Query Bar to run your search.

In Expert mode:

All searches executed in Expert mode are manually constructed. For example, if you want to find all documents with a doc_values_type of smtp, enter the following in the Expert mode Query Bar:

Type DOC_VALUES_TYPE: followed by smtp in the Query Bar, and click Enter.
Use the time picker and select the start and end time.
Click the search icon in the Query Bar to run your search.

Note
Filter terms are case-sensitive. Elasticsearch looks for an exact match entered in your search query, unless you create an exception using advanced query syntax. For example, if you search for sessions with a doc_values_type of http (lowercase), entering the query filter doc_values_type:HTTP will return "No Data Available" or incorrect results in the Event Table.