# Data cannot be queried by querying the time part of the log

**URL:** <https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783>\
**Category:** Elastic Search\
**Created:** [September 19, 2024, 10:19am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783 "2024-09-19T10:19:12Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![canli12138](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/canli12138/32/137716_2.png) [@canli12138](https://discuss.elastic.co/u/canli12138)\
**Post date:** [September 19, 2024, 10:19am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/1 "2024-09-19T10:19:12Z")

</div>

The data cannot be queried by querying the time part of the log. For example, the log content is XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX, and the data cannot be queried by log:17:53:05.  
// log:17:53:05

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [September 19, 2024, 8:10pm UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/2 "2024-09-19T20:10:25Z")

</div>

Thanks for reaching out here, @canli12138. Can you provide some further context as to what result you are expecting and the steps that can be taken to reproduce the results you are explaining? Are you getting any error messages?

---

<div class="post-metadata">

**Author:** ![canli12138](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/canli12138/32/137716_2.png) [@canli12138](https://discuss.elastic.co/u/canli12138)\
**Post date:** [September 27, 2024, 3:34am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/3 "2024-09-27T03:34:30Z")

</div>

When I query "log:17:53:05", I hope it returns data containing 17:53:05, such as this data: "XX:2024-08-22 17:53:05.947(35561|35863 ) XXXX:XXXXX", but it returns empty

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [September 27, 2024, 8:11am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/4 "2024-09-27T08:11:38Z")

</div>

Could you please explain how you indexing your logs -

If you're doing default indexing, Then it should be searchable -

```auto
POST test-1/_doc
{
  "log":"XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX"
}

GET test-1/_search

GET test-1/_search
{
  "query": {
    "match": {
      "log": "17:53:05"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![canli12138](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/canli12138/32/137716_2.png) [@canli12138](https://discuss.elastic.co/u/canli12138)\
**Post date:** [September 27, 2024, 10:03am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/5 "2024-09-27T10:03:50Z")

</div>

use match you will get some data like "XX:2024-08-22 17: **50** :05", because it cannot match exactly

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [September 27, 2024, 10:50am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/6 "2024-09-27T10:50:13Z")

</div>

Yeah thats totally depend on how you are indexing. You need to apply appropriate analyzer or you can use [wildcard](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html).

---

<div class="post-metadata">

**Author:** ![canli12138](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/canli12138/32/137716_2.png) [@canli12138](https://discuss.elastic.co/u/canli12138)\
**Post date:** [September 29, 2024, 6:59am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/7 "2024-09-29T06:59:07Z")

</div>

I try this query to find the data I want

```auto
{
  "query": {
    "wildcard": {
      "log.keyword":"*17:53:05*"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [September 30, 2024, 6:15am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/8 "2024-09-30T06:15:04Z")

</div>

This is how your token is generated using standard analyzer -

```auto

GET /_analyze?pretty
{
  "analyzer" : "standard",
  "text" : "XX:2024-08-22 17:53:05.947(35561|35863) XXXX:XXXXX"
}

{
  "tokens": [
    {
      "token": "xx",
      "start_offset": 0,
      "end_offset": 2,
      "type": "<ALPHANUM>",
      "position": 0
    },
    {
      "token": "2024",
      "start_offset": 3,
      "end_offset": 7,
      "type": "<NUM>",
      "position": 1
    },
    {
      "token": "08",
      "start_offset": 8,
      "end_offset": 10,
      "type": "<NUM>",
      "position": 2
    },
    {
      "token": "22",
      "start_offset": 11,
      "end_offset": 13,
      "type": "<NUM>",
      "position": 3
    },
    {
      "token": "17",
      "start_offset": 14,
      "end_offset": 16,
      "type": "<NUM>",
      "position": 4
    },
    {
      "token": "53",
      "start_offset": 17,
      "end_offset": 19,
      "type": "<NUM>",
      "position": 5
    },
    {
      "token": "05.947",
      "start_offset": 20,
      "end_offset": 26,
      "type": "<NUM>",
      "position": 6
    },
    {
      "token": "35561",
      "start_offset": 27,
      "end_offset": 32,
      "type": "<NUM>",
      "position": 7
    },
    {
      "token": "35863",
      "start_offset": 33,
      "end_offset": 38,
      "type": "<NUM>",
      "position": 8
    },
    {
      "token": "xxxx:xxxxx",
      "start_offset": 40,
      "end_offset": 50,
      "type": "<ALPHANUM>",
      "position": 9
    }
  ]
}

```

You need add create custom analyzer as per your requirement

OR

Just change the type of log to `keyword` and then perform the wildcard query.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2024, 6:15am UTC](https://discuss.elastic.co/t/data-cannot-be-queried-by-querying-the-time-part-of-the-log/366783/9 "2024-10-28T06:15:58Z")

</div>

Closed on October 28, 2024, 6:15am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.