Field Search Issue

Elastic Stack Elasticsearch
1

Hi Team,

We have defined mapping for a field as follows :

"host":{
"omit_term_freq_and_positions":true,
"omit_norms":true,"type":"string"
}

When we query for host value "londc0002.eur.xl" we are not getting any docs. Query is -

"query" : {
"query_string" : {
"query" : "+host:"londc0002.eur.xl"",
"default_operator" : "and",
"analyzer" : "search_analyzer",
"allow_leading_wildcard" : false,
"analyze_wildcard" : true
}
}

But when we query for the host value "10.1.0.0", we are getting back the data. Query is formed like -

"query" : {
"query_string" : {
"query" : "+host:"10.1.0.0"",
"default_operator" : "and",
"analyzer" : "search_analyzer",
"allow_leading_wildcard" : false,
"analyze_wildcard" : true
}
}

Both the terms "10.1.0.0" and "londc0002.eur.xl" exists for the host field.

Please provide your input.

Thanks..

2

If you are using standard analyzer for the host field, the value
"londc0002.eur.xl" is translated into two tokens "londc0002" and "eur.xml"
and then elasticsearch is trying to perform phrase search with these two
tokens and it fails because omit_term_freq_and_positions is set to false.
It's basically the same issue as
http://elasticsearch-users.115913.n3.nabble.com/Search-Issue-tc3824928.html

On Wednesday, March 21, 2012 7:16:29 AM UTC-4, Kranti wrote:

Hi Team,

We have defined mapping for a field as follows :

"host":{
"omit_term_freq_and_positions":true,
"omit_norms":true,"type":"string"
}

When we query for host value "londc0002.eur.xl" we are not getting any
docs.
Query is -

"query" : {
"query_string" : {
"query" : "+host:"londc0002.eur.xl"",
"default_operator" : "and",
"analyzer" : "search_analyzer",
"allow_leading_wildcard" : false,
"analyze_wildcard" : true
}
}

But when we query for the host value "10.1.0.0", we are getting back the
data. Query is formed like -

"query" : {
"query_string" : {
"query" : "+host:"10.1.0.0"",
"default_operator" : "and",
"analyzer" : "search_analyzer",
"allow_leading_wildcard" : false,
"analyze_wildcard" : true
}
}

Both the terms "10.1.0.0" and "londc0002.eur.xl" exists for the host field.

Please provide your input.

Thanks..

--
View this message in context:
http://elasticsearch-users.115913.n3.nabble.com/Field-Search-Issue-tp3845309p3845309.html
Sent from the Elasticsearch Users mailing list archive at Nabble.com.

3

Any input on this ..

4

Hi Kranti,

Was my answer unclear or are you asking for a second opinion?

Igor

On Friday, March 23, 2012 12:28:14 AM UTC-4, Kranti wrote:

Any input on this ..

--
View this message in context:
http://elasticsearch-users.​115913.n3.nabble.com/Field-​Search-Issue-​tp3845309p3850705.htmlhttp://elasticsearch-users.115913.n3.nabble.com/Field-Search-Issue-tp3845309p3850705.html
Sent from the Elasticsearch Users mailing list archive at Nabble.com.

5

Thanks a lot.