How can I force search to look into fields that marked as _Ignored

Hi All,

I'm using 7.15,

I'm saving some logs of failed tests, the log contain the test failed reason which I save in fields called:
"testcaseFailedReason"

I've noticed that I don't get values from this field in visualization that I've created.
So I go to dev Tools and search this field and I've noticed it is saved like this:

"testcaseFailedReason" : """Test failed: Assertion for errors, warnings and sensitive data in log file failed: ["Found an unexpected error log. line: Oct 14 15:03:55 ubuntu18-10-2020-tester-8azj7b localhost node[21]: [ERROR] [1634223835398] [clif_master[21]::http_endpoint.js:46] [FGERROR:HTTP_ENDPOINT_UNABLE_TO_LISTEN] Unable to listen on docker interface, Retrying: Error: listen EADDRINUSE 169.254.0.1:9002#012 at Server.setupListenHandle [as _listen2] (net.js:1360:14)#012 at listenInCluster (net.js:1401:12)#012 at doListen (net.js:1510:7)#012 at _combinedTickCallback (internal/process/next_tick.js:142:11)#012 at process._tickDomainCallback (internal/process/next_tick.js:219:9) "] """,

And in addition it is ignored list:
"_ignored" : [
"testcase.failure.keyword",
"testcaseFailedReason.keyword",
"testcase.$.name.keyword"
],

Why from the first place it is entered to ignored list? How can I fix it?
If it is already in ignore list, How can I force the search engine to look into this field?
Why it is saved with """value""" ?

Thanks,
Shay

_ignored field | Elasticsearch Guide [7.15] | Elastic explains what _ignored is about.

What is the testcaseFailedReason field mapped as?

This is typically ignored because the value is too large to be indexed as a single term.

JSON strings under the default mapping are indexed twice. Given a doc like this:

{ "myTextField" : "Hello World" }

... it will be indexed as the following fields and values:

  1. The text field "myText" with terms hello and world
  2. The keyword field "myText.keyword" with the single term Hello World

Keyword fields always have an ignore_above setting which is designed to trim too-large keywords and your content falls foul of this. The text field will be searchable but you'll need to have a good understanding of how your message will have been chopped into words which is awkward because it's machine-speak with [ ] : / _. ( ) characters - not the whitespace commonly used for language like this paragraph. This is why we invented the wildcard field and this blog gives a good overview and decision flow-chart at the end to help decide if it is suitable for your needs.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.