How to use slash ('/') in Kibana Discovery?

Question

I'm testing ELK stack for nginx-access logs. It looks good except I have not found a way to search records in Kibana Discovery (v5.3.2) with a path that start with "/test/a". Search works if I remove slashes, but in this case, I get what I don't need - "/ololo/ololo?test=1"

I tried different requests:

path:/\/test\/a/
path:/\\/test\\/a/
path:"/test/a"
path:"\/test\/a"
path:"\\/test\\/a"

but nothing works as I expect.

Records:

[
{
    ...
    "path": "/test/a1"
    ...
},
{
    ...
    "path": "/test/a2"
    ...
},
{
    ...
    "path": "/ololo/ololo?test=1"
    ...
},        
]

Mapping:

"path": {
  "type": "string", 
  "index": "analyzed", 
},

Is there any way to search using slashes as part of pattern?

Update:

These patterns do not work too:

path:/.*\/test\/a.*/
path:/[\/]test[\/]a/

Answer 1

You need to change the mapping of the path field to not be analyzed, otherwise the slashes will not be indexed.

The mapping should be like this:

"path": {
  "type": "string", 
  "index": "not_analyzed",    <--- change this
},

Note that you need to delete your index and re-create it with the proper mapping in order for this to work.

After that you'll be able to search using the following query path:"/test/a"

Answer 2

Use this query as example:

{
  "query": {
    "query_string": {
      "fields": [
        "path.keyword"
      ],
      "query": "\\/test\\/a\\/*",
      "analyzer": "keyword",
      "analyze_wildcard": true
    }
  }
}