DSL query match doesnt work

Elastic Stack Elasticsearch
1 
GET /qstats_index/_search
 {
 "query": {
   
 "match": { "queue_name": "SYSTEM" }

doesnt match even though there are documents out there

 "hits" : [
  {
    "_index" : "qstats_index",
    "_type" : "qstats",
    "_id" : "oq0g_GoBKkUShOkmq4ml",
    "_score" : 1.0,
    "_source" : {
      "pers_put_bytes" : 0,
      "interval_end_date_time" : "2019-05-26T12:31:28.000Z",
      "pers_get_bytes" : 0,
      "creation_time" : "05.01.17",
      "pers_get_count" : 0,
      "nonpers_time_on_q_avg" : 0,
      "interval_start_date_time" : "2019-05-26T12:21:28.000Z",
      "nonpers_browse_count" : 0,
      "queue_name" : "SYSTEM.BROKER.ADMIN.STREAM",
      "put1_fail_count" : 0,

if i search for full exact queue name, it is working. am i missing any setting?

2

Hey,

it depends on your mapping if this works. If you have mapped that field as a keyword, than you would need to type the full name in your query. Can you share your mapping for that field as well?

Also, in order to get more information why a document has not matched there is the explain API.

hope this helps!

--Ale

3 
 "queue_name": {
 "type": "text",
 "fields": {
 "keyword": {
 "type": "keyword",
 "ignore_above": 256
  }
  }
  },

it is set up keyword, how can i change it? I used logstash to create this index from reading a database using the jdbc plugin.

i was just reading this

https://www.elastic.co/blog/strings-are-dead-long-live-strings

it says with the above mapping i should be able to search using both keyword and text, is that not correct? Anycase, please let me know how i can change this so i can do partial searches instead of having to specify the entire queue name.

4

you just suffix the field name with .keyword and use that field for exact matches.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.