Searching an index
A query_string (Lucene/KQL) search that runs on submit, pages by infinite scroll, and is bounded by a relative time range.
The query
The query box runs a query_string search — Lucene syntax, which is also what a KQL-shaped
query mostly is — against the selected index. So level:error AND NOT kubernetes.namespace:dev
works exactly as it does in Kibana’s query bar.
Searches run on submit or on an index change, never per keystroke. On a phone this is not a nicety: a per-keystroke search against a large index is a good way to get rate limited on the way to typing a word.
Results page by infinite scroll — scrolling near the bottom grows the loaded window rather than making you tap “next”.
Time range
A relative time-range filter using Elasticsearch date math (now-15m, now-24h, and
friends) bounds both the results and the live tail, whenever the index has a
timestamp field. Where an index has no date field, the filter is simply not offered rather
than silently doing nothing.
Reading a hit
Tapping a hit opens its raw _source as JSON. Fields mapped as date render as local
time wherever they appear — in the table, in list rows, and in the record — because a
UTC timestamp is one more piece of mental arithmetic you do not want at 3am.
Back to Elasticsearch.