# I am not able to find a word which is seprated by (.)

**URL:** <https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828>\
**Category:** Kibana\
**Created:** [September 8, 2017, 9:46am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828 "2017-09-08T09:46:30Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 8, 2017, 9:46am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/1 "2017-09-08T09:46:30Z")

</div>

I am new to ELk .I am not able to find a word which is seprated by (.) for example: javax.ejb.duplicatekeyexception  
so when i only search duplicatekeyexception . kibana does not show any result , kindly please help me in resolving this issue .

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 8, 2017, 9:58am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/2 "2017-09-08T09:58:31Z")

</div>

the standard text analyzer of elasticsearch will not split on .  
to find it you would have to search for the full exception(fieldname:"javax.ejb.duplicatekeyexception")

if you want to search for the single word you would have to include a custom analyzer for the searched field in the index mapping

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 8, 2017, 10:39am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/3 "2017-09-08T10:39:05Z")

</div>

thanks for the reply sir,  
i searched alot about custom analyzer but i didn't get where to write all those put,get api request and how to see its output on kibana .could you please explain me the steps of making an analyzer using elasticsearch , logstash and kibana.

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 8, 2017, 11:15am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/4 "2017-09-08T11:15:26Z")

</div>

The analyzer is only on elasticsearch site and can/must be set for each index.  
It can only be set on new indices or in templates for new indices.

1. create new index with analyzer  
1.1 go to the dev tools in kibana  
1.2 execute th following(replace \<indexname\>, \<type\> and \<fieldname\>:

next post template creation for automatic index creation

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 8, 2017, 11:22am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/5 "2017-09-08T11:22:37Z")

</div>

create template for indices that are automatically created

1. got to dev tools in kibana
2. execute the following(replace all that is in \<\>)

```
PUT _template/<some template name>
{
  "order": 0,
  "template": "<pattern for indexname e.g. elk-*>",
  "settings": {
     "analysis": {
       "analyzer": {
         "point_analyzer": {
           "type": "pattern",
           "pattern": "\\.|\\s"
         }
       }
     }
   },
   "mappings": {
       "<type>": {
        "properties": {
           "<fieldname>": {
             "type": "text",
             "analyzer": "point_analyzer"
          }
        }
      }
   }
}

```

1. let logstash create an index with a name in the new index pattern

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 8, 2017, 12:28pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/6 "2017-09-08T12:28:13Z")

</div>

> [@Shaoranlaos](#):
>
> 3 index a document in the new index

thanks for the help!  
i have completed all the steps but after this also m not able to get the result in kibana.

message:"duplicatekeyexception" i am seraching and still it is not giving any output.

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 8, 2017, 12:30pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/7 "2017-09-08T12:30:12Z")

</div>

this my logstash.conf file:

input {  
file {

```
path => "xyz/s.log"		

 start_position => "beginning"	
 sincedb_path => "xyz/loginput1.sincedb"
ignore_older => 0

```

codec =\> multiline {  
pattern =\> "^\s"  
what =\> "previous"  
}  
}  
}

filter  
{  
date {  
match =\> ["timestamp" , "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]  
target =\> "@timestamp"  
add\_field =\> { "debug" =\> "timestampMatched"}  
}  
}

output {

```
            stdout {
                    codec => rubydebug 
            }

```

if "xyz1" in [message] {  
email {  
to =\> 'technical@logstash.net'  
from =\> 'monitor@logstash.net'  
subject =\> 'Alert - %{title}'  
body =\> "Tags: %{tags}\n\Content:\n%{message}"  
domain =\> '[mail.logstash.net](http://mail.logstash.net)'  
port =\> 25  
}  
}  
elasticsearch {

```
		action => "index"
		hosts => "localhost" 
	    
	    index => "logdemo12"
	
		 
   		    
	    
	    }

```

}

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 8, 2017, 12:31pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/8 "2017-09-08T12:31:54Z")

</div>

this is what i am exceuting in kibana dev tool:

PUT customindex1  
{  
"settings": {  
"analysis": {  
"analyzer": {  
"point\_analyzer": {  
"type": "pattern",  
"pattern": "\.|\s"  
}  
}  
}  
},  
"mappings": {  
"dotanlayzer": {  
"properties": {  
"message": {  
"type": "text",  
"analyzer": "point\_analyzer"  
}  
}  
}  
}  
}

PUT \_template/customtemplate  
{  
"order": 0,  
"template": "logdemo1-\*",  
"settings": {  
"analysis": {  
"analyzer": {  
"point\_analyzer": {  
"type": "pattern",  
"pattern": "\.|\s"  
}  
}  
}  
},  
"mappings": {  
"dotanlayzer": {  
"properties": {  
"message": {  
"type": "text",  
"analyzer": "point\_analyzer"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 8, 2017, 12:48pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/9 "2017-09-08T12:48:25Z")

</div>

with your current logstash configuration you would have to change the template with the following command (in dev-tool):

```
PUT _template/customtemplate
{
   "order":0,
   "template":"logdemo12",
   "settings":{
      "analysis":{
         "analyzer":{
            "point_analyzer":{
               "type":"pattern",
               "pattern":"\\.|\\s"
            }
         }
      }
   },
   "mappings":{
      "_default_":{
         "properties":{
            "message":{
               "type":"text",
                "analyzer":"point_analyzer"
             }
          }
      }
   }
}

```

and

```
 DELETE logdemo12

```

than you could try again

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 11, 2017, 5:29am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/10 "2017-09-11T05:29:40Z")

</div>

> [@Shaoranlaos](#):
>
> create template for indices that are automatically c

Thanks for the help..  
I am able to see the results when i use GET method but when i search on kibana UI then it gives me nothing. so for that what i have to do?

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 11, 2017, 5:43am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/11 "2017-09-11T05:43:34Z")

</div>

If you see it with a GET Request to ES and not in Kibana the only thing that comes to mind is the refresh of the configured index in Kibana

- 

```
     Management -> Index Patterns

```

- 

```
     Delete old index pattern

```

- 

```
     Create a new Index Pattern with the new indexname logdemo12

```

![](https://us1.discourse-cdn.com/elastic/original/2X/2/2485d26919316b1d80aa60f5ca8e2cb5bc0275fe.jpg)

![](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52e3d8429dc9df354e80745a95a85b3abf8eb09e.jpg)

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 11, 2017, 6:17am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/12 "2017-09-11T06:17:32Z")

</div>

I did this also still not working.  
steps which i am doing is:

1. i executed (put/indexname , put/customindex) in dev tool
2. i executed (put/templatename, put/customtemplate) in dev tool
3. i ran the logstash.conf file with above configurations.
4. i searched on kibana and did'nt get the result!

Thanks in advance and sorry for troubling u alot

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 11, 2017, 7:34am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/13 "2017-09-11T07:34:00Z")

</div>

can you post the response to the GET request from Elasticsearch for the document that you get back

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 11, 2017, 1:22pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/14 "2017-09-11T13:22:07Z")

</div>

{  
"took": 114,  
"timed\_out": false,  
"\_shards": {  
"total": 5,  
"successful": 5,  
"failed": 0  
},  
"hits": {  
"total": 27,  
"max\_score": 8.557227,  
"hits": [  
{  
"\_index": "logdemo12",  
"\_type": "logs",  
"\_id": "xbzvzh",  
"\_score": 8.557227,  
"\_source": {  
"@timestamp": "2017-09-11T06:12:09.251Z",  
"message": "[7/25/17 7:49:12:583 CDT] xxxxxxxxxxxxxxxxxxxxx com.xxx.NullPointerException  
"@version": "1",  
"path": "D:/b.log",  
"host": "abcdef"  
}  
},

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 11, 2017, 1:48pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/15 "2017-09-11T13:48:02Z")

</div>

okay i cann't see any problem why it shouldn't be visible in Kibana  
the obvious thing would be that the timeframe in kibana is to short but other than that... 🤔

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 11, 2017, 3:54pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/16 "2017-09-11T15:54:08Z")

</div>

What does raw field means?

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 13, 2017, 6:42am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/17 "2017-09-13T06:42:56Z")

</div>

thanks for the help christian it worked for few of the text not for all 🙂

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 13, 2017, 6:56am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/18 "2017-09-13T06:56:22Z")

</div>

any idea what is the difference between the messages that are shown and the ones that are not shown?

> [@abc1](#):
>
> What does raw field means?

can't think of anything

---

<div class="post-metadata">

**Author:** ![abc1](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@abc1](https://discuss.elastic.co/u/abc1)\
**Post date:** [September 18, 2017, 5:53am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/19 "2017-09-18T05:53:00Z")

</div>

> [@Shaoranlaos](#):
>
> erence between the messages that are shown and the ones that are not shown?

Now it is working ! after adding this line "pattern": "\.|\s|\:|\_"  
Thanks alot Christian 🙂 !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2017, 5:53am UTC](https://discuss.elastic.co/t/i-am-not-able-to-find-a-word-which-is-seprated-by/99828/20 "2017-10-16T05:53:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.