Hi, analyzed text mapping is for fulltext search. For example, if you had a lot of biography data, and you needed to find the biographies that have certain words, phrases, topics, etc - you would want analyzed text. You don't want analyzed text mapping for doing log analysis.
The mapping of the logs should be plain keyword
, not multi-field. If the field has pageUrl.keyword
and pageUrl.analyzed
, then it is multi-field.
https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html#multi-fields
Trying to do wildcard search on pageUrl-as-analyzed text is not going to work, because the Elasticsearch tokenizer breaks up the string for full-text search, which is not what you want in your data.
When you filter pageUrl:http://example.com/
, I'm not entirely sure if that references the keyword part by default. The multi-fields mapping will lead to other instances of confusion for Kibana, too.