rashidkpc/Kibana — pull request #97 by awheeler (2012-10-12 18:48:23+00:00)
Title: Kibana ruby Splunk-like analysis

Excellent work on this project, thank you.

I've incorporated @r-duran's changes (which added support for using a | to indicate a mode), and enhanced them to support multiple fields, so the following yields an analysis incoporating both clienthost and request:
@type:"nginx_web" AND response:"404" | trend clienthost request

I've addressed somewhat the concern your raised about the query containing "|" pipes by using a regex to split on the first | char after which there are no more ' or " chars.