\documentclass[10pt,a4paper]{article}

% Packages
\usepackage{fancyhdr}           % For header and footer
\usepackage{multicol}           % Allows multicols in tables
\usepackage{tabularx}           % Intelligent column widths
\usepackage{tabulary}           % Used in header and footer
\usepackage{hhline}             % Border under tables
\usepackage{graphicx}           % For images
\usepackage{xcolor}             % For hex colours
%\usepackage[utf8x]{inputenc}    % For unicode character support
\usepackage[T1]{fontenc}        % Without this we get weird character replacements
\usepackage{colortbl}           % For coloured tables
\usepackage{setspace}           % For line height
\usepackage{lastpage}           % Needed for total page number
\usepackage{seqsplit}           % Splits long words.
%\usepackage{opensans}          % Can't make this work so far. Shame. Would be lovely.
\usepackage[normalem]{ulem}     % For underlining links
% Most of the following are not required for the majority
% of cheat sheets but are needed for some symbol support.
\usepackage{amsmath}            % Symbols
\usepackage{MnSymbol}           % Symbols
\usepackage{wasysym}            % Symbols
%\usepackage[english,german,french,spanish,italian]{babel}              % Languages

% Document Info
\author{spartan782}
\pdfinfo{
  /Title (kibana.pdf)
  /Creator (Cheatography)
  /Author (spartan782)
  /Subject (Kibana Cheat Sheet)
}

% Lengths and widths
\addtolength{\textwidth}{6cm}
\addtolength{\textheight}{-1cm}
\addtolength{\hoffset}{-3cm}
\addtolength{\voffset}{-2cm}
\setlength{\tabcolsep}{0.2cm} % Space between columns
\setlength{\headsep}{-12pt} % Reduce space between header and content
\setlength{\headheight}{85pt} % If less, LaTeX automatically increases it
\renewcommand{\footrulewidth}{0pt} % Remove footer line
\renewcommand{\headrulewidth}{0pt} % Remove header line
\renewcommand{\seqinsert}{\ifmmode\allowbreak\else\-\fi} % Hyphens in seqsplit
% This two commands together give roughly
% the right line height in the tables
\renewcommand{\arraystretch}{1.3}
\onehalfspacing

% Commands
\newcommand{\SetRowColor}[1]{\noalign{\gdef\RowColorName{#1}}\rowcolor{\RowColorName}} % Shortcut for row colour
\newcommand{\mymulticolumn}[3]{\multicolumn{#1}{>{\columncolor{\RowColorName}}#2}{#3}} % For coloured multi-cols
\newcolumntype{x}[1]{>{\raggedright}p{#1}} % New column types for ragged-right paragraph columns
\newcommand{\tn}{\tabularnewline} % Required as custom column type in use

% Font and Colours
\definecolor{HeadBackground}{HTML}{333333}
\definecolor{FootBackground}{HTML}{666666}
\definecolor{TextColor}{HTML}{333333}
\definecolor{DarkBackground}{HTML}{015470}
\definecolor{LightBackground}{HTML}{EFF4F6}
\renewcommand{\familydefault}{\sfdefault}
\color{TextColor}

% Header and Footer
\pagestyle{fancy}
\fancyhead{} % Set header to blank
\fancyfoot{} % Set footer to blank
\fancyhead[L]{
\noindent
\begin{multicols}{3}
\begin{tabulary}{5.8cm}{C}
    \SetRowColor{DarkBackground}
    \vspace{-7pt}
    {\parbox{\dimexpr\textwidth-2\fboxsep\relax}{\noindent
        \hspace*{-6pt}\includegraphics[width=5.8cm]{/web/www.cheatography.com/public/images/cheatography_logo.pdf}}
    }
\end{tabulary}
\columnbreak
\begin{tabulary}{11cm}{L}
    \vspace{-2pt}\large{\bf{\textcolor{DarkBackground}{\textrm{Kibana Cheat Sheet}}}} \\
    \normalsize{by \textcolor{DarkBackground}{spartan782} via \textcolor{DarkBackground}{\uline{cheatography.com/57408/cs/15187/}}}
\end{tabulary}
\end{multicols}}

\fancyfoot[L]{ \footnotesize
\noindent
\begin{multicols}{3}
\begin{tabulary}{5.8cm}{LL}
  \SetRowColor{FootBackground}
  \mymulticolumn{2}{p{5.377cm}}{\bf\textcolor{white}{Cheatographer}}  \\
  \vspace{-2pt}spartan782 \\
  \uline{cheatography.com/spartan782} \\
  \end{tabulary}
\vfill
\columnbreak
\begin{tabulary}{5.8cm}{L}
  \SetRowColor{FootBackground}
  \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Cheat Sheet}}  \\
   \vspace{-2pt}Not Yet Published.\\
   Updated 21st March, 2018.\\
   Page {\thepage} of \pageref{LastPage}.
\end{tabulary}
\vfill
\columnbreak
\begin{tabulary}{5.8cm}{L}
  \SetRowColor{FootBackground}
  \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Sponsor}}  \\
  \SetRowColor{white}
  \vspace{-5pt}
  %\includegraphics[width=48px,height=48px]{dave.jpeg}
  Measure your website readability!\\
  www.readability-score.com
\end{tabulary}
\end{multicols}}




\begin{document}
\raggedright
\raggedcolumns

% Set font size to small. Switch to any value
% from this page to resize cheat sheet text:
% www.emerson.emory.edu/services/latex/latex_169.html
\footnotesize % Small font.


\begin{tabularx}{17.67cm}{x{4.2175 cm} x{6.4106 cm} x{6.2419 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{3}{x{17.67cm}}{\bf\textcolor{white}{Terminology}}  \tn
% Row 0
\SetRowColor{LightBackground}
\{\{nobreak\}\}{\bf{Terminology}} & {\bf{Description}} & {\bf{Example}} \tn 
% Row Count 3 (+ 3)
% Row 1
\SetRowColor{white}
Term & A single word, subset of value & "term" \tn 
% Row Count 5 (+ 2)
% Row 2
\SetRowColor{LightBackground}
Phrase & \{\{nobreak\}\}A group of words inside quotes, subset of value & "this is a phrase" \tn 
% Row Count 9 (+ 4)
% Row 3
\SetRowColor{white}
Field & Is the name of the field that contains values. Appending a colon tells Lucene this is a Field & @meta.host: \tn 
% Row Count 16 (+ 7)
% Row 4
\SetRowColor{LightBackground}
Value & A value you wish to search & \{\{nobreak\}\}"this is a value or phrase" \tn 
% Row Count 19 (+ 3)
\hhline{>{\arrayrulecolor{DarkBackground}}---}
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{5.7358 cm} x{5.5671 cm} x{5.5671 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{3}{x{17.67cm}}{\bf\textcolor{white}{Elastic Special Charactures}}  \tn
% Row 0
\SetRowColor{LightBackground}
{\bf{Characters}} & {\bf{Description}} & {\bf{Example}} \tn 
% Row Count 2 (+ 2)
% Row 1
\SetRowColor{white}
\{\{nobreak\}\}+ - \&\& || ! () \{\} {[}{]} \textasciicircum{} " \textasciitilde{} * ? : \textbackslash{} & \{\{nobreak\}\}These characters need to be escaped & \{\{nobreak\}\}"www.google.com/search\textbackslash{}?source..." \tn 
% Row Count 6 (+ 4)
\hhline{>{\arrayrulecolor{DarkBackground}}---}
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{2.7999 cm} x{3.6234 cm} x{5.1057 cm} x{4.941 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{4}{x{17.67cm}}{\bf\textcolor{white}{Operators}}  \tn
% Row 0
\SetRowColor{LightBackground}
\{\{nobreak\}\}{\bf{Operator}} & \{\{nobreak\}\}{\bf{Alternate Form}} & {\bf{Description}} & \{\{nobreak\}\}{\bf{Example}} \tn 
% Row Count 4 (+ 4)
% Row 1
\SetRowColor{white}
AND & \&\& & Only result that include both X AND Y & \{\{literal\}\}http AND \seqsplit{www.google.com} \tn 
% Row Count 8 (+ 4)
% Row 2
\SetRowColor{LightBackground}
OR & || & \{\{nobreak\}\}Only results that Include either X OR Y & http OR dns \tn 
% Row Count 13 (+ 5)
% Row 3
\SetRowColor{white}
NOT & ! & Only results that do NOT include X & NOT ssl \tn 
% Row Count 16 (+ 3)
% Row 4
\SetRowColor{LightBackground}
TO &  & Results from value X to value Y & {[} 10 TO 100 {]} \tn 
% Row Count 19 (+ 3)
% Row 5
\SetRowColor{white}
+ &  & \{\{nobreak\}\}X must be present in document text & \seqsplit{+www.google.com} \tn 
% Row Count 23 (+ 4)
% Row 6
\SetRowColor{LightBackground}
- &  & \{\{nobreak\}\}X must not be present in document text & \seqsplit{-www.google.com} \tn 
% Row Count 28 (+ 5)
% Row 7
\SetRowColor{white}
( ) &  & Grouping of values, typically used to apply more advanced Boolean logic & http AND (get OR post) \tn 
% Row Count 34 (+ 6)
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{2.7999 cm} x{3.6234 cm} x{5.1057 cm} x{4.941 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{4}{x{17.67cm}}{\bf\textcolor{white}{Operators (cont)}}  \tn
% Row 8
\SetRowColor{LightBackground}
{[} {]} &  & Inclusive range search, typically a number field but can search text. Will include specified values. & @meta.resp\_port{[}1 TO 1024{]} \tn 
% Row Count 9 (+ 9)
% Row 9
\SetRowColor{white}
\{ \} &  & Exclusive range search, typically a number field but can search text. Will exclude specified values. & @meta.resp\_port\{0 TO 1025\} \tn 
% Row Count 18 (+ 9)
% Row 10
\SetRowColor{LightBackground}
\seqsplit{\_exists\_} &  & Special operator that allows finding  documents containing a specified field & \_exists\_: http.host \tn 
% Row Count 25 (+ 7)
% Row 11
\SetRowColor{white}
\{\{nobreak\}\}NOT \seqsplit{\_exists\_} &  & By combining the NOT operator you can find documents that are missing a field & \{\{nobreak\}\}NOT \_exists\_: \seqsplit{http.user\_agent} \tn 
% Row Count 32 (+ 7)
\hhline{>{\arrayrulecolor{DarkBackground}}----}
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{3.374 cm} x{8.435 cm} x{5.061 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{3}{x{17.67cm}}{\bf\textcolor{white}{Field Searching}}  \tn
% Row 0
\SetRowColor{LightBackground}
{\bf{Field Search}} & {\bf{Description}} & {\bf{Example}} \tn 
% Row Count 2 (+ 2)
% Row 1
\SetRowColor{white}
\seqsplit{field:value} & The Colon states the previous text is a field and the text after it is the value you want to find & \seqsplit{http.host:www.google.com} \tn 
% Row Count 7 (+ 5)
% Row 2
\SetRowColor{LightBackground}
fiel\textbackslash{}?:value & Wildcards be used inside a field name but need  to be escaped & \seqsplit{http.*:www.google.com} \tn 
% Row Count 11 (+ 4)
\hhline{>{\arrayrulecolor{DarkBackground}}---}
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{2.5305 cm} x{8.2663 cm} x{6.0732 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{3}{x{17.67cm}}{\bf\textcolor{white}{Term Modifiers}}  \tn
% Row 0
\SetRowColor{LightBackground}
{\bf{Modifier}} & {\bf{Description}} & {\bf{Example}} \tn 
% Row Count 2 (+ 2)
% Row 1
\SetRowColor{white}
? & Single Character wildcard & \{\{literal\}\}www.googl?.com \tn 
% Row Count 4 (+ 2)
% Row 2
\SetRowColor{LightBackground}
* & Multiple Character wildcard & \{\{literal\}\}www.goo*.com \tn 
% Row Count 6 (+ 2)
% Row 3
\SetRowColor{white}
\textasciitilde{} & Fuzzy search based on Levenshtein distance & \{\{literal\}\}www.google.com\textasciitilde{} \tn 
% Row Count 9 (+ 3)
% Row 4
\SetRowColor{LightBackground}
\textasciitilde{}0.9 & Change weight of fuzzy search, 0 to 1, default 0.5, higher number = Higher similarity & \{\{literal\}\}www.google.com\textasciitilde{}0.9 \tn 
% Row Count 14 (+ 5)
% Row 5
\SetRowColor{white}
\textasciitilde{}2 & \{\{nobreak\}\}Proximity search of values within \# of each other & \{\{nobreak\}\}"program DOS"\textasciitilde{}10 \tn 
% Row Count 18 (+ 4)
% Row 6
\SetRowColor{LightBackground}
\textasciicircum{} & Boost term to be more relevant in searches Default: 1, Must be Positive, can be decimal & "linux"\textasciicircum{}3 \tn 
% Row Count 23 (+ 5)
\hhline{>{\arrayrulecolor{DarkBackground}}---}
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{1.647 cm} x{5.1057 cm} x{4.1175 cm} x{5.5998 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{4}{x{17.67cm}}{\bf\textcolor{white}{Lucene REGEX}}  \tn
% Row 0
\SetRowColor{LightBackground}
{\bf{REGEX}} & {\bf{Description}} & {\bf{Example}} & {\bf{Matches}} \tn 
% Row Count 3 (+ 3)
% Row 1
\SetRowColor{white}
// & \{\{nobreak\}\}All regex starts and ends with a forward slash & \{\{nobreak\}\}/REGEX HERE/ &  \tn 
% Row Count 8 (+ 5)
% Row 2
\SetRowColor{LightBackground}
- & Range operator, a through z, 0 through 9 & /{[}A-Z{]}/ & \{\{nobreak\}\}Any single uppercase letter \tn 
% Row Count 12 (+ 4)
% Row 3
\SetRowColor{white}
. & Match any single character & /positv./ & positv ending in anything \tn 
% Row Count 15 (+ 3)
% Row 4
\SetRowColor{LightBackground}
? & Preceding value is optional & /joh?n/ & john or jon \tn 
% Row Count 18 (+ 3)
% Row 5
\SetRowColor{white}
+ & Preceding value matched one or more times & /go+gle/ & \{\{nobreak\}\}gogle with the o possibly repeating indefinitely \tn 
% Row Count 23 (+ 5)
% Row 6
\SetRowColor{LightBackground}
* & Preceding value matched zero or more times & /z*/ & \{\{nobreak\}\}nothing or z possibly repeating indefinitely \tn 
% Row Count 28 (+ 5)
% Row 7
\SetRowColor{white}
| & \{\{nobreak\}\}Alteration operator, typically referred to as OR & \seqsplit{/text|sms/} & text or sms \tn 
% Row Count 33 (+ 5)
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{17.67cm}{x{1.647 cm} x{5.1057 cm} x{4.1175 cm} x{5.5998 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{4}{x{17.67cm}}{\bf\textcolor{white}{Lucene REGEX (cont)}}  \tn
% Row 8
\SetRowColor{LightBackground}
{[} {]} & \{\{nobreak\}\}List, Matches one of the given expressions inside & /{[}abc123{]}/ & a or b or c or 1 or 2 or 3 \tn 
% Row Count 5 (+ 5)
% Row 9
\SetRowColor{white}
( ) & Grouping, groups expressions together & \{\{nobreak\}\}/(({[}ab{]}) OR {[}12{]})/ & a1 or a2 or b1 or b2 \tn 
% Row Count 9 (+ 4)
% Row 10
\SetRowColor{LightBackground}
\{ \} & Intervals, repeat the preceding expression & /{[}ab{]}\{1,3\}/ & ab or abab or ababab \tn 
% Row Count 13 (+ 4)
% Row 11
\SetRowColor{white}
\textbackslash{} & Escape character & /{[}a\textbackslash{}-z{]}/ & a or - or z \tn 
% Row Count 15 (+ 2)
% Row 12
\SetRowColor{LightBackground}
" & Only needs escaped because its java regex &  &  \tn 
% Row Count 19 (+ 4)
\hhline{>{\arrayrulecolor{DarkBackground}}----}
\end{tabularx}
\par\addvspace{1.3em}



\end{document}