I'm using Kibana 4 with ElasticSearch 1.4.4 to store logs pushed by Logstash. I have a 'hostname' field which is not_analyzed and can't find how to query with a regex on this field.
I want to search on the first part of this field, because in some events the hostname is short on other is FQDN. For example i want all my1-machine2.my3-domain.tld and my1-machine2
When I search for hostname:"my1-machine2*" I got events with short hostname (a lot) and FQDN (a few). When I use a filter to have hostname: "my1-machine2.my3-domain.tld" I see events which were not visible with my query
I chose hostname.raw because my hostname field is analyzed.
You are right, it sounds like your hostname field is still analyzed (at least in some indices). Did you change the mapping to not analyzed before indexing data for the first time or while there where already logstash indices created?
Mapping changes are not applied to already existing data.
You could try to choose a time range where you are sure that the hostname field was set to not analyzed.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.