Data cannot be queried by querying the time part of the log

Elastic Search
1

The data cannot be queried by querying the time part of the log. For example, the log content is XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX, and the data cannot be queried by log:17:53:05.
// log:17:53:05

2

Thanks for reaching out here, @canli12138. Can you provide some further context as to what result you are expecting and the steps that can be taken to reproduce the results you are explaining? Are you getting any error messages?

3

When I query "log:17:53:05", I hope it returns data containing 17:53:05, such as this data: "XX:2024-08-22 17:53:05.947(35561|35863 ) XXXX:XXXXX", but it returns empty

4

Could you please explain how you indexing your logs -

If you're doing default indexing, Then it should be searchable -

POST test-1/_doc
{
  "log":"XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX"
}

GET test-1/_search

GET test-1/_search
{
  "query": {
    "match": {
      "log": "17:53:05"
    }
  }
}
5

use match you will get some data like "XX:2024-08-22 17:50:05", because it cannot match exactly

6

Yeah thats totally depend on how you are indexing. You need to apply appropriate analyzer or you can use wildcard.

7

I try this query to find the data I want

{
  "query": {
    "wildcard": {
      "log.keyword":"*17:53:05*"
    }
  }
}
8

This is how your token is generated using standard analyzer -


GET /_analyze?pretty
{
  "analyzer" : "standard",
  "text" : "XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX"
}

{
  "tokens": [
    {
      "token": "xx",
      "start_offset": 0,
      "end_offset": 2,
      "type": "<ALPHANUM>",
      "position": 0
    },
    {
      "token": "2024",
      "start_offset": 3,
      "end_offset": 7,
      "type": "<NUM>",
      "position": 1
    },
    {
      "token": "08",
      "start_offset": 8,
      "end_offset": 10,
      "type": "<NUM>",
      "position": 2
    },
    {
      "token": "22",
      "start_offset": 11,
      "end_offset": 13,
      "type": "<NUM>",
      "position": 3
    },
    {
      "token": "17",
      "start_offset": 14,
      "end_offset": 16,
      "type": "<NUM>",
      "position": 4
    },
    {
      "token": "53",
      "start_offset": 17,
      "end_offset": 19,
      "type": "<NUM>",
      "position": 5
    },
    {
      "token": "05.947",
      "start_offset": 20,
      "end_offset": 26,
      "type": "<NUM>",
      "position": 6
    },
    {
      "token": "35561",
      "start_offset": 27,
      "end_offset": 32,
      "type": "<NUM>",
      "position": 7
    },
    {
      "token": "35863",
      "start_offset": 33,
      "end_offset": 38,
      "type": "<NUM>",
      "position": 8
    },
    {
      "token": "xxxx:xxxxx",
      "start_offset": 40,
      "end_offset": 50,
      "type": "<ALPHANUM>",
      "position": 9
    }
  ]
}

You need add create custom analyzer as per your requirement

OR

Just change the type of log to keyword and then perform the wildcard query.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.