Elasticsearch substring query - no output values

Grafana Elasticsearch
1

  • What Grafana version and what operating system are you using?
    Grafana v9.2.3, ubuntu 22.04

  • What are you trying to achieve?

I’m trying to use a substring query to extract the first 4 letters from a field.
Ideally I want to show all characters until the dash “-”.

  • How are you trying to achieve it?

For the first 4 Characters:
“substring(‘host.keyword’, 0, 3)”

For all characters up to the dash:
“substring(host.keyword, indexOf(host.keyword, "-"))”

  • What happened?
    No error message, no output values. If i try this query directly in OpenSearch I get values.

  • What did you expect to happen?

example name: TEST-Server1
“substring(‘host.keyword’, 0, 3)” should output “TEST”

example name: TESTZ-Server1
“substring(host.keyword, indexOf(host.keyword, "-"))” should output “TESTZ”

What am i doing wrong? There is definitly data and simple queries like {“find”: “terms”, “field”: “host.keyword”} work as expected. Is my format wrong?