Filter field

[Akaren]

Hi, I am having Kibana 5.4.0. I am filtering in top bar:
a) attrs.from:iptel.org -> this works, returns attrs.from where substring is "iptel.org"
b) iptel.org -> works, return any field that contains substring "iptel.org"
c) iptel -> DOESN'T WORK, returns "No results found". How so?
d) "asterisk"iptel"asterisk" -> works, return any field that contains substring "iptel"
e) attrs.from:iptel -> DOESN'T WORK
f) attrs.from:iptel.org -> works

I thought that I have specify that I want substring but if a) and b) returns substring I expect also c) to do it so.
attrs.from is searchable keyword that looks like "sip:3400017733@iptel.org".

Why c) and e) doesn't work?

[YuWatanabe]

What is you field type for attrs.from in mapping ?

[Akaren]

string, searchable, analyzed...

[YuWatanabe]

@Akaren

"sip:3400017733@iptel.org"

Assuming your using the standard analyzer, your from field is analyzed as below.

POST test/_analyze
{
  "analyzer" : "standard",
  "text" : "sip:3400017733@iptel.org"
}

Above will be anaylzed as below,

{
  "tokens": [
    {
      "token": "sip",
      "start_offset": 0,
      "end_offset": 3,
      "type": "<ALPHANUM>",
      "position": 0
    },
    {
      "token": "3400017733",
      "start_offset": 4,
      "end_offset": 14,
      "type": "<NUM>",
      "position": 1
    },
    {
      "token": "iptel.org",
      "start_offset": 15,
      "end_offset": 24,
      "type": "<ALPHANUM>",
      "position": 2
    }
  ]
}

iptel will not match any of the token inside the inverted index. Thus c) and e) will not return anything.

[Akaren]

Oh, I see! ありがとうございました。

[YuWatanabe]

どういたしまして!