Werk #20234: Correct inline help of check_elasticsearch_query search pattern and field names
| Component | Checks & agents | ||||||
| Title | Correct inline help of check_elasticsearch_query search pattern and field names | ||||||
| Date | Aug 7, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Bug Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
The inline help of the active check "Query elasticsearch logs" (check_elasticsearch_query) described the wrong query syntax.
The "Search pattern" field claimed that the Kibana query language (KQL) could be used and linked to the KQL documentation.
This was never the case: the check sends the pattern verbatim as an Elasticsearch query_string query to the _count API.
The query string syntax is similar to KQL, but a distinct and separate language.
The help now links to the query string documentation and points out that regular expressions can be embedded by wrapping them in forward slashes.
The "Fieldnames to query" field claimed that regexp queries were allowed and linked to the regexp query documentation.
The entered field names are passed to the fields parameter of the same query_string query, which supports wildcards, not regular expressions.
The regexp query documented under the old link matches values within a single named field and is never issued by this check.
The help now describes wildcards and links to the query string documentation.
This is a documentation fix only, the behavior of the check is unchanged.