My log text contains a comma, how do I match him when I search?
I tried to use “\”, it seems to be useless.
This might be due to the mapping on the field you are trying to search. If the field you are searching on is analyzed, it means the search input will also be analyzed, which generally means the words are all stemmed, some input is discarded (like punctuation and stop words), and then the search is executed.
If you are trying to match an exact string, you'll want to do so on a field that is mapped as a keyword instead of one that is mapped as text. This is often done with multi-fields, where you index the value multiple ways and access the different values through multiple field pointers. For example, you may store the text/analyzed version on name, and the keyword/non-analyzed version on name.keyword. That way you can do the exact match on name.keyword.
You can read a but more about multi-fields here: https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.