# Issues getting search results

**URL:** <https://discuss.elastic.co/t/issues-getting-search-results/156929>\
**Category:** Elasticsearch\
**Created:** [November 15, 2018, 6:56pm UTC](https://discuss.elastic.co/t/issues-getting-search-results/156929 "2018-11-15T18:56:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![HockeyFan0000](https://avatars.discourse-cdn.com/v4/letter/h/b4bc9f/32.png) [@HockeyFan0000](https://discuss.elastic.co/u/HockeyFan0000)\
**Post date:** [November 15, 2018, 6:56pm UTC](https://discuss.elastic.co/t/issues-getting-search-results/156929/1 "2018-11-15T18:56:16Z")

</div>

I'm trying to do a query for server logs. The search is returning results but there are a couple of issues.

1. I'm specifying the server name, yet I'm getting results back for other servers in the same domain.

2. Even though I'm specifying the query get results back from the past hour, they're coming back from two hours before, i.e. if I perform the search at 1pm, the results are returning from 12pm. The search returns the correct results if I specify sorting by timestamp but this seems to take longer for the results to appear so I would rather not do that unless I have to.

Any help you can give is greatly appreciated.

Here's my query (with edited log name and server name):

var searchParams = {  
index: 'logs\*',  
"body": {  
"from" : 0, "size": 50,  
"sort": [  
{  
"timestamp": {  
"order": "desc",  
"unmapped\_type": "boolean"  
}  
}  
],  
"query": {  
"bool": {  
"must": [  
{  
"match" : {"gl2\_source\_input" : "579f7b6696d78a4f6cbfa745"},  
"match" : {"source" : "[server01.fakedomain.com](http://server01.fakedomain.com)"},  
"match" : {"EventID" : "5145"}  
},  
{  
"range": {  
"timestamp": {  
"gte": "now-1h",  
"lte": "now/m",  
"time\_zone": "-05:00"  
}  
}  
}  
],  
"must\_not":   
}  
},

```
	}

```

}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 26, 2018, 4:02pm UTC](https://discuss.elastic.co/t/issues-getting-search-results/156929/2 "2018-11-26T16:02:24Z")

</div>

hey,

you are using a `match` query on the `source` field. Depening on the mapping of the source field you might be ending up searching for `server01 OR fakedomain OR com`, which might explain your additional result. You might want to search against the `source.keyword` field - but this is just a wild guess.

---

<div class="post-metadata">

**Author:** ![HockeyFan0000](https://avatars.discourse-cdn.com/v4/letter/h/b4bc9f/32.png) [@HockeyFan0000](https://discuss.elastic.co/u/HockeyFan0000)\
**Post date:** [November 27, 2018, 4:31pm UTC](https://discuss.elastic.co/t/issues-getting-search-results/156929/3 "2018-11-27T16:31:22Z")

</div>

I got the answer elsewhere, but 'spinscale' was correct. The 'match' query was the wrong way to go. The corrected query is below:

```auto
var searchParams = {
index: 'logs*',
    "body": {
      "from" : 0, "size": 50,
      "sort": [
        {
          "timestamp": {
            "order": "desc",
            "unmapped_type": "boolean"
          }
        }
      ],
        "query": {
            "bool": {
                "filter": [
                    { "term" : {"gl2_source_input" : "579f7b6696d78a4f6cbfa745"} },
                    { "term" : {"source" : "server01.fakedomain.com"} },
                    { "term" : {"EventID" : "5145"} },
                    {
                        "range": {
                            "timestamp": {
                              "gte": "now-1h",
                              "lte": "now/m",
                              "time_zone": "-05:00"
                            }
                        }
                    }
                ]
            }
        },

    }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2018, 4:31pm UTC](https://discuss.elastic.co/t/issues-getting-search-results/156929/4 "2018-12-25T16:31:23Z")

</div>

Closed on December 25, 2018, 4:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.