The data cannot be queried by querying the time part of the log. For example, the log content is XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX, and the data cannot be queried by log:17:53:05.
// log:17:53:05
Thanks for reaching out here, @canli12138. Can you provide some further context as to what result you are expecting and the steps that can be taken to reproduce the results you are explaining? Are you getting any error messages?
When I query "log:17:53:05", I hope it returns data containing 17:53:05, such as this data: "XX:2024-08-22 17:53:05.947(35561|35863 ) XXXX:XXXXX", but it returns empty
Could you please explain how you indexing your logs -
If you're doing default indexing, Then it should be searchable -
POST test-1/_doc
{
"log":"XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX"
}
GET test-1/_search
GET test-1/_search
{
"query": {
"match": {
"log": "17:53:05"
}
}
}
use match you will get some data like "XX:2024-08-22 17:50:05", because it cannot match exactly
Yeah thats totally depend on how you are indexing. You need to apply appropriate analyzer or you can use wildcard.
I try this query to find the data I want
{
"query": {
"wildcard": {
"log.keyword":"*17:53:05*"
}
}
}
This is how your token is generated using standard analyzer -
GET /_analyze?pretty
{
"analyzer" : "standard",
"text" : "XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX"
}
{
"tokens": [
{
"token": "xx",
"start_offset": 0,
"end_offset": 2,
"type": "<ALPHANUM>",
"position": 0
},
{
"token": "2024",
"start_offset": 3,
"end_offset": 7,
"type": "<NUM>",
"position": 1
},
{
"token": "08",
"start_offset": 8,
"end_offset": 10,
"type": "<NUM>",
"position": 2
},
{
"token": "22",
"start_offset": 11,
"end_offset": 13,
"type": "<NUM>",
"position": 3
},
{
"token": "17",
"start_offset": 14,
"end_offset": 16,
"type": "<NUM>",
"position": 4
},
{
"token": "53",
"start_offset": 17,
"end_offset": 19,
"type": "<NUM>",
"position": 5
},
{
"token": "05.947",
"start_offset": 20,
"end_offset": 26,
"type": "<NUM>",
"position": 6
},
{
"token": "35561",
"start_offset": 27,
"end_offset": 32,
"type": "<NUM>",
"position": 7
},
{
"token": "35863",
"start_offset": 33,
"end_offset": 38,
"type": "<NUM>",
"position": 8
},
{
"token": "xxxx:xxxxx",
"start_offset": 40,
"end_offset": 50,
"type": "<ALPHANUM>",
"position": 9
}
]
}
You need add create custom analyzer as per your requirement
OR
Just change the type of log to keyword
and then perform the wildcard query.