How to get the case insensitive results from a regex query

Elastic Stack Elasticsearch
1

Hi,

i am currently using the below query, is there a way i can get case insensitive results out of this? all my fields are "not_analyzed". please help.

{
"query" : {
"bool" : {
"must" : [ {
"range" : {
"filetimestamp" : {
"from" : "2016-01-01T00:00:00.000-0800",
"to" : "2016-09-09T13:51:59.257-0700",
"include_lower" : true,
"include_upper" : true
}
}
}, {
"wildcard" : {
"filename" : "ABC"
}
}, {
"regexp" : {
"msg_ext" : {
"value" : ".Test Status: FAILED.",
"flags_value" : 65535
}
}
} ]
}
},
"fields" : "filename",
"sort" : [ {
"filetimestamp" : {
"order" : "desc"
}
} ],
"aggregations" : {
"filenames" : {
"terms" : {
"field" : "filename",
"size" : 1000
}
}
}
}

2

I don't see how you can run full-text queries if all your fields are not analyzed. Can you post your mapping, an example o your documents and what you would want to get back with your query? I guess you can achieve what you need by analyzing your fields accordingly to your requirements, but I'd need to know more to point to the right solution.

3

thanks for your response, below is my mapping.

"mappings": {
"default":{
"dynamic_templates":[
{
"string_fields":{
"mapping":{
"index":"not_analyzed",
"type":"string",
"doc_values":true
},
"match_mapping_type":"string",
"match":"*"
}
}
],
"properties":{
"filename":{
"index":"not_analyzed",
"type":"string"
},
"filepath":{
"index":"not_analyzed",
"type":"string"
},
"line_num":{
"index":"not_analyzed",
"type":"long"
},
"msg_ext":{
"index":"not_analyzed",
"type":"long"
}
},
"_all":{
"enabled":false
}
}
}

i am using the below match query

{
"query": {
"match": {
"msg_ext": ".test.status:.f."
}
}
}

i am using match query , but i would expect to work with regexp/wild card as well.
and i am expecting the below kind of documents back from the query .

Abc 2 cmd 24 Test Status: FAILED

4

If you want to run a full-text query you need to have your fields analyzed. Would be best if you can make the match query work, as regexp queries are much slower. Regexes are really different from what lucene and its inverted index are supposed to help with.