I am having a very odd issue and hoping you have seen something like this previously.
We have a keyword field application.api.responseText
Mapping for that field is:
"application": {
"properties": {
"api": {
"properties": {
"responseText": {
"ignore_above": 8190,
"type": "keyword"
},
}
}
}
The data going into this field is always a string, and varies from message to message.
Sample data that would be in that field (I have highlighted the specific string we are trying to isolate):
Doc 1:
{"errors":[{"code":"SERVICE_ERROR","messages":["Catalyst Error Code: OTTOERR-100","java.lang.RuntimeException: Catalyst Error Code: OTTOERR-100","Catalyst Error Code: OTTOERR-100"],"transactionId":"617081","dateTime":{"offset":{"totalSeconds":0,"id":"Z","rules":{"transitions":[],"transitionRules":[],"fixedOffset":true}},"year":2020,"month":"JANUARY","dayOfMonth":29,"dayOfWeek":"WEDNESDAY","dayOfYear":29,"hour":19,"minute":10,"second":27,"nano":449000000,"monthValue":1}}],"statusCode":200,"transactionId":"1599599617081","eligible":false,"blacklistedFromFreePreview":null,"blacklistedFromFreeTrial":null,"householdFoundInMarketingFile":null,"targetedOfferFoundInOffersCatalog":null,"requestedFreePreviewDisabled":null,"requestedOfferMatchedTargeted":null,"requestedOfferIsReturned":null,"ottoErrorCode":"OTTOERR-100","ottoErrorMessage":"This account is not eligible for any offers.","offers":null,"netWorks":[]}
Doc2:
{"errors":[],"statusCode":200,"transactionId":"158046551","eligible":true,"blacklistedFromFreePreview":false,"blacklistedFromFreeTrial":false,"householdFoundInMarketingFile":true,"targetedOfferFoundInOffersCatalog":false,"requestedFreePreviewDisabled":null,"requestedOfferMatchedTargeted":null,"requestedOfferIsReturned":null,"ottoErrorCode":null,"ottoErrorMessage":null,"offers":[{"baseOffer":{"name":"TV Stream","promotionDays":7,"promotionType":"Free Trial","description":" Free Trial Offer","category":"base","id":"147872"},"premiums":[{"name":"Cinemax with On Demand","price":"7.5","description":"Cinemax with On Demand","ncsNetworkIds":["53"],"category":"Premium","id":"433971"},{"name":"Showtime with On Demand","price":"7.5","description":"Showtime with On Demand","ncsNetworkIds":["312"],"category":"Premium","id":"419321"},{"name":"Premium Pack","price":"15.0","description":"Premium Bundle","ncsNetworkIds":["330","31 ... (truncated by me for this post)
Doc3:
“service error”
Doc4:
“some string with other words in it”
I run a query in Kibana… such as:
application.api.responseText: *eligible\”\:true*
I get no results for some days data, other days I get results – Yes I have verified that the field contains the results I am expecting
I run another query in Kibana… such as:
Application.api.responseText: *
I get no results that include the “eligible”:true string in the message for some days, yet I get results for other days – Yes I have verified some messages contain this string
I run another query without any wildcards in Kibana just a blank query:
Now I get results where that field contains “eligible”:true
From what I can tell… Some days will return results, other days will not return results (even though I have verified the results are there) but only when a wildcard is used to search on that field.
