# Hit a log only all specific keyword exists?

**URL:** <https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323>\
**Category:** Elasticsearch\
**Created:** [December 16, 2015, 8:50am UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323 "2015-12-16T08:50:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hacksign](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hacksign/32/5918_2.png) [@Hacksign](https://discuss.elastic.co/u/Hacksign)\
**Post date:** [December 16, 2015, 8:50am UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/1 "2015-12-16T08:50:13Z")

</div>

I have a search statement like this:

```
{
    "size" : 10,
    "query" : {
        "bool" : {
            "must" : [
                {
                    "match" : {
                        "log._kv_" : {
                            "query" : "officecheck macros vba_code cmd.exe",
                            "operator" : "and"
                        }
                    }
                }
            ]
        }
    },
    "highlight" : {
        "fields" : {
            "log._kv_" : {}
        }
    }
}

```

I want pick out a log which contain all keywords I mentioned. But I found the result is not what I'm expecting ....Some of the keyword doesn't exists in highlight part in result(cmd not exists in below record) :

```
      "highlight" : {
        "log._kv_" : ["additional_info <em>officecheck</em> ole <em>macros</em> <em>vba</em>_<em>code</em> Public Sub Main()\nConst ProcName As String = \"\"\nOn", "additional_info <em>officecheck</em> ole <em>macros</em> subfilename r:\\sav6\\work_channel0_9\\11793486", "additional_info <em>officecheck</em> ole <em>macros</em> <em>vba</em>_filename Module1.bas", "additional_info <em>officecheck</em> ole <em>macros</em> stream_path _VBA_PROJECT_CUR/VBA/Module1"]
      }

```

So, anyone tell me how can I write a statement to pick out the log only when all keywords exists in a specific field ?

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [December 16, 2015, 11:04am UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/2 "2015-12-16T11:04:59Z")

</div>

Hi,  
I think the query looks okay, but with the default highlighter settings you only see a limited number of fragments with 100 characters size. Have you tried specifying different values for `fragment_size` and `number_of_fragments` as described in the [Highlighting-API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-highlighting.html)?

---

<div class="post-metadata">

**Author:** ![Hacksign](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hacksign/32/5918_2.png) [@Hacksign](https://discuss.elastic.co/u/Hacksign)\
**Post date:** [December 16, 2015, 11:45am UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/3 "2015-12-16T11:45:02Z")

</div>

Thanks~this is the solution.  
BTW, Is there any length restrict of a string type field ? my log string could be a verylong string ~

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [December 16, 2015, 12:06pm UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/4 "2015-12-16T12:06:51Z")

</div>

[This thread](https://discuss.elastic.co/t/maximum-document-size/13086) suggests a theoretical limit on the maximum document size in Lucene of 2GB, also the size of a single token seems to be limited to approx. 32kB.  
Still, it might be useful to split very large documents in logical subsections (e.g. a book into chapters or pages). What sizes are we talking about?

---

<div class="post-metadata">

**Author:** ![Hacksign](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hacksign/32/5918_2.png) [@Hacksign](https://discuss.elastic.co/u/Hacksign)\
**Post date:** [December 16, 2015, 1:41pm UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/5 "2015-12-16T13:41:12Z")

</div>

32kb \* 1024 = 32768 chracters of each field ?  
that seems enought for my situation.  
I'm pretty sure a single document will not over 2GB.

Thanks for your answer !

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [December 16, 2015, 2:23pm UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/6 "2015-12-16T14:23:29Z")

</div>

To clarify, the 32kB is a limit on the length of each term in a field, so if your field it analyzed each term (or word, token depending on your terminology) can't be longer than that. However, you can still have as many terms in that field as you like. This might only be a restriction if your field is not analyzed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:30pm UTC](https://discuss.elastic.co/t/hit-a-log-only-all-specific-keyword-exists/37323/7 "2017-07-05T23:30:34Z")

</div>