Q: How to search a substring in a json string attribute in Kibana (Elastic Search)? I have an attribute stored in Elastic Search DB. The attribute is somewhat of this form:- 
{
"a":{
  "key1":"value1",
  "key2":"value2"
    }
} 

Now, I want to search for all instances which have value1 defined. How to achieve this using Kibana query?

A: Below is the query:

GET ${index}/_search
{
    "from": 0,
    "size": 200,
    "query": {
        "bool": {
            "filter": [
                {
                    "bool": {
                        "must": [
                            {
                                "match_phrase": {
                                    "a.key1": {
                                        "query": "value1",
                                        "slop": 0,
                                        "zero_terms_query": "NONE",
                                        "boost": 1
                                    }
                                }
                            }
                        ],
                        "adjust_pure_negative": true,
                        "boost": 1
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    }
}


If you want to query all the instances, you also need to know the document count. If the count is bigger than 10000, you need to use the scroll.
