I've indexed some data with a field named "observed" that is an object with
two other fields named "filename" and "pathname". These fields are
analyzed and have multiple values.
The following query executed without problems:
"query_string" : { "fields" : ["observed.filename",
"observed.pathname"], "query" : "Autorun", "use_dis_max" : true }
but when I change it to the following it fails:
"query_string" : {
"fields" : ["observed.*"],
"query" : "Autorun",
"use_dis_max" : true
}
with the error:
"SearchPhaseExecutionException[Failed to execute phase [query], total
failure; shardFailures {[jHW46VKNS_G6Cnrdzko_WA][file_analysis][0]:
SearchParseException[[file_analysis][0]: from[-1],size[-1]: Parse Failure
[Failed to parse source [{\t"query": {\t "query_string" : {\t
"fields" : ["observed."],\t "query" : "Autorun",\t
"use_dis_max" : true\t }\t}}]]]; nested: NumberFormatException[For
input string: "Autorun"]; }{[jHW46VKNS_G6Cnrdzko_WA][file_analysis][1]:
SearchParseException[[file_analysis][1]: from[-1],size[-1]: Parse Failure
[Failed to parse source [{\t"query": {\t "query_string" : {\t
"fields" : ["observed."],\t "query" : "Autorun",\t
"use_dis_max" : true\t }\t}}]]]; nested: NumberFormatException[For
input string: "Autorun"]; }]
Why is that? The docs indicate it should work.
Also odd is that the following works:
"query_string" : {
"fields" : ["observed.f*"],
"query" : "Autorun",
"use_dis_max" : true
}
but this fails:
"query_string" : {
"fields" : ["observed.p*"],
"query" : "Autorun",
"use_dis_max" : true
}
I am Running 0.90.0. The mapping for the fields looks like:
"observed" : {
"type": "object",
"properties" : {
"pathname" : { "type": "string", "analyzer": "path" },
"filename" : {
"type": "multi_field",
"fields": {
"filename": { "type": "string", "analyzer": "path" },
"whole" : { "type": "string", "analyzer": "lowercase_keyword" }
}
},
There are some other fields in there as well.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.