Quiz Entry - updated: 2026.09.24
Which advanced Lucene query operators does Kibana offer beyond plain keywords, and when are they useful?
Fuzzy search ~, proximity search "…"~N, boosting ^, and regular expressions between slashes /…/: for typos and variants, words near each other, ranking, and structured patterns.
| Operator | Example | Matches |
|---|---|---|
| Fuzzy | svchost~, lsass~1 |
Terms within an edit distance (Levenshtein), e.g. scvhost |
| Proximity | "program DOS"~10 |
Both words within 10 positions of each other |
| Boost | "linux"^3 |
Raises the relevance of matches for this term |
| Regex | /joh?n(ath[oa]n)/ |
jon, john, jonathan, johnathon … |
| Regex character class | /doc([mx]?)/ |
doc, docm, docx |
Fuzzy search is surprisingly useful in security: malware often names itself scvhost.exe or lsas.exe to look like the real system process at a glance. svchost~ finds these look-alikes along with the genuine one, and the path or hash then tells them apart.
Regex and fuzzy queries are expensive for the same reason leading wildcards are: they have to test many terms. Combine them with a narrow time range and other filters.
Go deeper:
Levenshtein distance — Wikipedia — the edit distance behind fuzzy search.