Data truncated when including number following by '.'


(Mac Jouz) #1

Hi,

I'm using ELK (ES v1.1.1) and I'm facing a strange behaviour when trying to
aggregate some kind of data including a number following by a '.' (dot)

I built a panel with kibana to show Top 10 Java method used in my
application and I can see that the result provided by ES is truncated when
there is one number following by a '.' (dot)

For instance the ES result is
[...]
{
"term" : "connector.abczcm9stub",
"count" : 1387
}, {
"term" : "cachedmapper.com.test.jca.abc.copabczcm9",
"count" : 1387
},
[...]

whereas the x_java_method which is expected in this case is

 [...]
  {
    "term" : 

"cachedmapper.com.test.jca.abc.copabczcm9.connector.abczcm9stub",
"count" : 1387
},
[...]

Of course the result is correct when there is no number followed by a '.'

 [...] 
 {
    "term" : 

"cachedmapper.com.test.jca.abc.copabcxa0f.connector.abcxa0fstub",
"count" : 148
},
[...]

More details:
=> ES full request:

curl -XGET
'http://localhost/elasticsearch/logstash-2014.04.29/_search?pretty' -d '{
"facets": {
"terms": {
"terms": {
"field": "x_java_method",
"size": 10,
"order": "count",
"exclude": []
},
"facet_filter": {
"fquery": {
"query": {
"filtered": {
"query": {
"bool": {
"should": [
{
"query_string": {
"query": "type : "appli_type""
}
}
]
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"from": 1398722400000,
"to": "2014-04-29T22:00:00.000Z"
}
}
},
{
"fquery": {
"query": {
"query_string": {
"query": "x_java_method:*Stub"
}
},
"_cache": true
}
}
]
}
}
}
}
}
}
}
},
"size": 0
}'

=> ES Result :

{
"took" : 179,
"timed_out" : false,
"_shards" : {
"total" : 10,
"successful" : 10,
"failed" : 0
},
"hits" : {
"total" : 8742790,
"max_score" : 0.0,
"hits" : [ ]
},
"facets" : {
"terms" : {
"_type" : "terms",
"missing" : 0,
"total" : 24278,
"other" : 1323,
"terms" : [ {
"term" :
"cachedmapper.com.test.jca.abc.copabczcnc.connector.abczcncstub",
"count" : 14199
}, {
"term" :
"cachedmapper.com.test.jca.abc.copabczcnb.connector.abczcnbstub",
"count" : 4817
}, {

  •    "term" : "connector.abczcm9stub",*
    
  •    "count" : 1387*
    
  •  }, {*
    
  •    "term" : "cachedmapper.com.test.jca.abc.copabczcm9",*
    
  •    "count" : 1387*
    
  •  }*, {
      "term" : 
    

"cachedmapper.com.test.jca.abc.copabczcna.connector.abczcnastub",
"count" : 342
}, {
"term" :
"cachedmapper.com.test.jca.def.defzcnj.connector.defzcnjstub",
"count" : 246
},* {*

  •    "term" : "connector.ghica017stub",*
    
  •    "count" : 174*
    
  •  }, {*
    
  •    "term" : "cachedmapper.com.test.jca.ghi.ghica017",*
    
  •    "count" : 174*
    
  •  }*, {
      "term" : 
    

"cachedmapper.com.test.jca.abc.copabcxa0f.connector.abcxa0fstub",
"count" : 148
}, {
"term" : "connector.ghica014stub",
"count" : 81
} ]
}
}
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/69410e42-2b0f-423a-b4f6-4869bea303a8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(system) #2