# Limit to rawmessage length and search

**URL:** <https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219>\
**Category:** Kibana\
**Created:** [May 17, 2016, 12:34pm UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219 "2016-05-17T12:34:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![himbeere](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@himbeere](https://discuss.elastic.co/u/himbeere)\
**Post date:** [May 17, 2016, 12:34pm UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219/1 "2016-05-17T12:34:22Z")

</div>

Hello.

I'm trying to search within a rawmessage field for a specific string but i get no results if the rawmessage is rather long. Is there a limit? Example:

```auto
rawmessage:
    device_id=bla [Root]system-notification-00257(traffic): start_time="2016-05-17 14:29:21" duration=0 policy_id=163 service=dns proto=17 src zone=zone dst zone=Uplink action=Permit sent=0 rcvd=0 src=1.2.3.4 dst=1.2.3.4 src_port=50633 dst_port=53 src-xlated ip=1.2.3.4 port=43614 dst-xlated ip=1.2.3.4 port=53 session_id=1983453 reason=Creation

```

Now when i search for "rawmessage: _Creation_" i get no hit. If the rawmessage is much shorter this generally works.

any hints would be really appreciated.

thanks and cheers  
t.

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [May 17, 2016, 3:55pm UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219/2 "2016-05-17T15:55:31Z")

</div>

Hmmm, can you include your mapping for `rawmessage`? Thanks.

---

<div class="post-metadata">

**Author:** ![himbeere](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@himbeere](https://discuss.elastic.co/u/himbeere)\
**Post date:** [May 18, 2016, 7:55am UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219/3 "2016-05-18T07:55:33Z")

</div>

Hi Lukas.

Thanks for your answer. Here the mapping.

```auto
root@logserver01:/# curl -XGET http://localhost:9200/logs-2016.12.30/_mapping?pretty=true
{
  "logs-2016.12.30" : {
    "mappings" : {
      "_default_" : {
        "_all" : {
          "enabled" : false
        },
        "_ttl" : {
          "enabled" : true,
          "default" : 7776000000
        },
        "dynamic_templates" : [ {
          "disable_analyze" : {
            "mapping" : {
              "index" : "not_analyzed",
              "store" : "no",
              "type" : "string"
            },
            "match" : "*",
            "match_mapping_type" : "string"
          }
        } ]
      },
      "noJSON" : {
        "_all" : {
          "enabled" : false
        },
        "_ttl" : {
          "enabled" : true,
          "default" : 7776000000
        },
        "dynamic_templates" : [ {
          "disable_analyze" : {
            "mapping" : {
              "index" : "not_analyzed",
              "store" : "no",
              "type" : "string"
            },
            "match" : "*",
            "match_mapping_type" : "string"
          }
        } ],
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "facility" : {
            "type" : "string",
            "index" : "not_analyzed"
          },
          "host" : {
            "type" : "string",
            "index" : "not_analyzed"
          },
          "rawmessage" : {
            "type" : "string",
            "index" : "not_analyzed"
          },
          "severity" : {
            "type" : "string",
            "index" : "not_analyzed"
          },
          "tag" : {
            "type" : "string",
            "index" : "not_analyzed"
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [May 19, 2016, 3:30pm UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219/4 "2016-05-19T15:30:41Z")

</div>

Looks to me like `rawmessage` is `not_analyzed`. I'm not sure why it is working at all when the string length is smaller, but if you'd like to be able to search the way you've suggested, you'd need to change your mapping to analyze `rawmessage`. Hope this helps!

---

<div class="post-metadata">

**Author:** ![himbeere](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@himbeere](https://discuss.elastic.co/u/himbeere)\
**Post date:** [May 20, 2016, 8:01am UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219/5 "2016-05-20T08:01:54Z")

</div>

Yeah. Seems to be the problem. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:52pm UTC](https://discuss.elastic.co/t/limit-to-rawmessage-length-and-search/50219/6 "2017-07-06T13:52:49Z")

</div>

Closed on July 6, 2017, 1:52pm UTC