How to search for [ using Dashboards Query Language

Question

I'm trying to find a field with content including "Provided Hash [0" I'm using DQL on the OpenSearch Dashboard to attempt this query.

The field I'm searching on is called "message"

The values I'm parsing have many arbitrary characters before and after the part of the message I'm looking at. Of the two messages below I would like to return the first but not the second

Just some random text Provided Hash [0abcdef] then some more random text

Just some random text Provided Hash [1abcdef] then some more random text

I'm currently using the below query which is returning no results

message:"Provided Hash [0"

An example of a message which I'm expecting to get as a result would have the following in the message

Provided Hash [0abcdef]

Answer 1

Reserved characters for DQL: \ ( ) : < > " *

Use a backslash (\) to escape reserved characters.

https://docs.opensearch.org/docs/latest/dashboards/dql/#reserved-characters

In your case you can try Provided Hash \\[0* query with out " at the beginning or end.

hint: If you add " your query " it will be a multi_match, without quote it will be a query_string query and you will see the results.

EDIT: If the above not works try with keyword field type.

EDIT 2:

Sample data:

PUT reserved_chars/_doc/1
{"text": "Just some random text Provided Hash [0abcdef] then some more random text"}

PUT reserved_chars/_doc/2
{"text": "Just some random text Provided Hash [1hdaslkh] then some more random text"}

DQL or DSL query search:

text.keyword : *Provided Hash [0abcdef]*