Kibana4 Beta3: Battling with wildcard search on not_analyzed fields

Ali_Kheyrollahi · January 31, 2015, 9:56am

Hi,

I really haven't found a consistent way to use query window in Discover or
Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache Hits"
And I have to escape only backslashes (well I am using double quotes so it
is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and I
have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_""\Total Local Cache Hits"
(nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.)\Total Local Cache Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8670910d-2fef-485f-ba6d-7e32851be397%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 1, 2015, 8:48am

Anyone please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover or
Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so it
is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_""\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/989971d3-3c4d-49ce-82bb-8dbfe7e559f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 2, 2015, 1:08pm

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover or
Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so it
is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_""\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Itamar_Syn_Hershko · February 2, 2015, 1:20pm

It looks like your field is analyzed and you are trying to query it
assuming its not_analyzed (e.g. one string). Hard to say without seeing
your index mapping.

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover
or Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so
it is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_""\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4Ztkn6wx%2BJB8iJVyLwmZTbX30SKuFkZOvZ38E-96guj7eQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 2, 2015, 9:57pm

Thanks for responding.

It is surely not_analyzed - hence my frustration. Here is the mapping

{
"my_index": {
"mappings": {
"my_type": {
"properties": {
"@timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"CounterName": {
"type": "string",
"index": "not_analyzed"
},
"CounterValue": {
"type": "double"
},
"DeploymentId": {
"type": "string",
"index": "not_analyzed"
},
"EventTickCount": {
"type": "long"
},
"PartitionKey": {
"type": "string",
"index": "not_analyzed"
},
"Role": {
"type": "string",
"index": "not_analyzed"
},
"RoleInstance": {
"type": "string",
"index": "not_analyzed"
},
"RowKey": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}

On Monday, 2 February 2015 13:20:49 UTC, Itamar Syn-Hershko wrote:

It looks like your field is analyzed and you are trying to query it
assuming its not_analyzed (e.g. one string). Hard to say without seeing
your index mapping.

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi <alio...@gmail.com
<javascript:>> wrote:

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover
or Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so
it is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local
Cache Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying to
look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_""\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Itamar_Syn_Hershko · February 2, 2015, 10:00pm

Can you try executing a simple term query in JSON using that query bar?

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 11:57 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

Thanks for responding.

It is surely not_analyzed - hence my frustration. Here is the mapping

{
"my_index": {
"mappings": {
"my_type": {
"properties": {
"@timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"CounterName": {
"type": "string",
"index": "not_analyzed"
},
"CounterValue": {
"type": "double"
},
"DeploymentId": {
"type": "string",
"index": "not_analyzed"
},
"EventTickCount": {
"type": "long"
},
"PartitionKey": {
"type": "string",
"index": "not_analyzed"
},
"Role": {
"type": "string",
"index": "not_analyzed"
},
"RoleInstance": {
"type": "string",
"index": "not_analyzed"
},
"RowKey": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}

On Monday, 2 February 2015 13:20:49 UTC, Itamar Syn-Hershko wrote:

It looks like your field is analyzed and you are trying to query it
assuming its not_analyzed (e.g. one string). Hard to say without seeing
your index mapping.

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi alio...@gmail.com
wrote:

Any help please??

On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:

Hi,

I really haven't found a consistent way to use query window in Discover
or Visualize tabs. My results become hit and miss and inconsistent.

So I am searching for types of "my_type" and I have a field called
CounterName and I am looking for \Windows Azure
Caching:Client(w3wp_2392)\Total Local Cache Hits

Funny thing is searching for verbatim value does not work:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
Hits"
And I have to escape only backslashes (well I am using double quotes so
it is literal, no?) and not brackets or colon:
CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local
Cache Hits"

Now, the 2392 number here is variable (pid on the box) so I am trying
to look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits and I have tried all these to no avail:

CounterName:"\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_*)\Total Local Cache
Hits"
CounterName:"\Windows Azure Caching:Client(w3wp_""\Total Local Cache
Hits" (nothing comes back)

And also tried regex:

CounterName:/\Windows Azure Caching:Client(w3wp_)\Total Local Cache
Hits/
CounterName:/\Windows Azure Caching:Client(w3wp_.)\Total Local Cache
Hits/
...

With many different combinations of replacing reserved chars with ?.

What am I doing wrong?

Thanks

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtkdXHJkBMLP_2Hjobzt06d0aCJj0MbmaskaqMSKRWh%3DQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 2, 2015, 11:32pm

This works (exact value)

{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_5412)\Failure
Exceptions"}}

But NOT this:
{"term":{"CounterName":"Caching"}}
Nor
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
Or this
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_)\Failure
Exceptions"}}

And not even this
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.+)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_)\Failure
Exceptions"}}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Itamar_Syn_Hershko · February 2, 2015, 11:39pm

inline

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 1:32 AM, Ali Kheyrollahi aliostad@gmail.com wrote:

This works (exact value)

{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_5412)\Failure
Exceptions"}}

As expected

But NOT this:
{"term":{"CounterName":"Caching"}}
Nor
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
Or this
{"term":{"CounterName":"\Windows Azure Caching:Client(w3wp_)\Failure
Exceptions"}}

As expected too - term query will take the entire string and look for
documents matching this exact query. .* has no meaning in this context, its
just a different string than the original, hence no hits.

And not even this
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_.+)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching:Client(w3wp_)\Failure
Exceptions"}}

I believe you should escape the parenthesis, this is getting parsed as a
regex grouping. See

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/327ba38a-9caf-41c1-8a45-f93be1532bf2%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvNWEKQ6_j3aEBrJX0vfBJX9APVQja1CqzBMjpyynZypA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 3, 2015, 10:00am

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp_.\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Itamar_Syn_Hershko · February 3, 2015, 1:41pm

Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead?

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp_.\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZvQkHvs2%2B2K0b53%2BJaFdP6qmiRWJvZU5hLKx0kgQj%3DCWA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 3, 2015, 5:56pm

Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure Caching:Client(w3wp_*)\Failure
Exceptions"}}

And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:

github.com/elastic/kibana

Kibana 4 beta3: Lucene queries

opened 11:47AM - 20 Jan 15 UTC

closed 03:09PM - 20 Jan 15 UTC

aliostad

Just one word that you guys have done an amazing work and we in the community so… grateful for it. Before posting this issue, I spend quite sometime investigating so I hope I am not asking too much of a dumb question: Basically I have struggled a lot with Lucene queries and I think there might be a collision of javascript/JSON special characters with Lucene but basically this query on an not_analyzed field brings back strange results: So I have tried with or without quote (single or double) and with or without bracket and this has been the only one bring some results back but surprisingly it does not filter correctly and brings back other CounterName as well. Am I missing something or this is a bug?

On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:

Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead?
Elasticsearch Platform — Find real-time answers at scale | Elastic

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi <alio...@gmail.com
<javascript:>> wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure
Caching:Client\(w3wp_.\)\Failure Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Itamar_Syn_Hershko · February 4, 2015, 12:20am

Here's a working gist:

gist.github.com

https://gist.github.com/synhershko/3d915a7819145f2d7a1f

ali

DELETE /mytest

PUT /mytest
{
   "mappings": {
      "test": {
         "properties": {
            "name": {
               "type": "string",
               "index": "not_analyzed"

This file has been truncated. show original

You need to double escape the slashes - not sure if this is by design or no
but that works now

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 7:56 PM, Ali Kheyrollahi aliostad@gmail.com wrote:

Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure
Caching:Client(w3wp_*)\Failure Exceptions"}}

And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:

Kibana 4 beta3: Lucene queries · Issue #2698 · elastic/kibana · GitHub

On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:

Thinking of it, I'm not sure why you are using regexp here - can you just
use wildcard query instead? Elasticsearch Platform — Find real-time answers at scale | Elastic
elasticsearch/reference/current/query-dsl-wildcard-query.html

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi alio...@gmail.com
wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure Caching:Client\(w3wp_.\)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure Caching\:Client\(w3wp_.\)\Failure
Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZtYtioqUuAyGWm%3DBf3Jxs8DpUvKUjeTsALO4m38-%3DOr8A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Ali_Kheyrollahi · February 4, 2015, 1:14pm

Thank you.

That is the same with regexp. I managed to get it working with using 4
backslashes.

On Wednesday, 4 February 2015 00:20:10 UTC, Itamar Syn-Hershko wrote:

Here's a working gist:

ali · GitHub

You need to double escape the slashes - not sure if this is by design or
no but that works now

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 7:56 PM, Ali Kheyrollahi <alio...@gmail.com
<javascript:>> wrote:

Wildcard does not work either.
{"wildcard":{"CounterName":"\Windows Azure
Caching:Client(w3wp_*)\Failure Exceptions"}}

And regardless, Regexp does not work so on its own right it is a bug.
Can you please help open the issue on GitHub? Already have an issue which
was closed:

Kibana 4 beta3: Lucene queries · Issue #2698 · elastic/kibana · GitHub

On Tuesday, 3 February 2015 13:42:11 UTC, Itamar Syn-Hershko wrote:

Thinking of it, I'm not sure why you are using regexp here - can you
just use wildcard query instead? Elasticsearch Platform — Find real-time answers at scale | Elastic
elasticsearch/reference/current/query-dsl-wildcard-query.html

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Feb 3, 2015 at 12:00 PM, Ali Kheyrollahi alio...@gmail.com
wrote:

No it doesn't which has been my experience:

{"regexp":{"CounterName":"\Windows Azure Caching:Client\(w3wp_.\)\Failure
Exceptions"}}
or
{"regexp":{"CounterName":"\Windows Azure
Caching\:Client\(w3wp_.\)\Failure Exceptions"}}

None of them work

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9a4eabaa-1634-46a5-aa8a-f2c47ccd5745%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/3ed729ef-697b-42e0-975b-3b3c86fd7734%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9607bc7a-f1d3-40fe-bcbc-732b23cfc734%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.