I posted some simple json documents within a 'message' property in an index.
here is the mapping I have:
Mappings for the WSLogging index:
{
"ws.loggingtesting-20180504": {
"mappings": {
"fluentd": {
"properties": {
"@log_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"@timestamp": {
"type": "date"
},
"level": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"logger_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"sequence_id": {
"type": "long"
}
}
}
}
}
}
I have 20 or so entries for logging that look like this:
Mappings for the WSLogging index:
{
"_index": "ws.loggingtesting-20180504",
"_type": "fluentd",
"_id": "XuyxKGMBTx62wVJBapS4",
"_version": 1,
"_score": null,
"_source": {
"level": "Info",
"message": "{ \"time\": \"2018-05-03 20:07:21.8465\", \"msg\": \"Testing02 0 on 5\\/3\\/18 - 8:07:21 PM\", \"@target_index\": \"LoggingTesting\", \"HostName\": \"G625C\", \"FullHostName\": \"G625C\", \"IPAddress\": \"10.211.55.3\", \"DomainName\": \"\", \"UserName\": \"G625C\\\\gggg\", \"CallerMemberName\": \"LogInfo\", \"CallerFilePath\": \"C:\\\\code\\\\LoggingTesting\\\\WS.Logging\\\\WSNLogLogger.cs\", \"CallerLineNumber\": 75 }",
"logger_name": "WS.Logging.WSNLogLogger",
"sequence_id": 2,
"@timestamp": "2018-05-03T20:07:21.000000000-05:00",
"@log_name": "LoggingTesting"
},
"fields": {
"@timestamp": [
"2018-05-04T01:07:21.000Z"
]
},
"sort": [
1525396041000
]
}
In DevTools I'm trying to use the Query DSL of different variations. This is the latest, and there are no syntax errors, but there are 0 hits:
GET ws.loggingtesting-20180504/_search
{
"query": {
"query_string": {
"query": "testing03*"
}
}
}
I've also tried
"query" : {
"match" : {
"query": {
"message" : "testing03*"} }}
any assistance is greatly appreciated. Thank you.