# Logstash+elasticsearch problems with queries after upgrade to ES 1.2.1

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-problems-with-queries-after-upgrade-to-es-1-2-1/18424>\
**Category:** Elasticsearch\
**Created:** [July 1, 2014, 7:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-problems-with-queries-after-upgrade-to-es-1-2-1/18424 "2014-07-01T19:49:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oleksandr\_Kunytsia](https://avatars.discourse-cdn.com/v4/letter/o/bc8723/32.png) [@Oleksandr\_Kunytsia](https://discuss.elastic.co/u/Oleksandr_Kunytsia)\
**Post date:** [July 1, 2014, 7:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-problems-with-queries-after-upgrade-to-es-1-2-1/18424/1 "2014-07-01T19:49:39Z")

</div>

Hello,

I'm using logtash + ES for storing logs

After I've updated ES to 1.2.1, I discovered strange behavior of searches.

_@source\_host:mta01.domain1.com:_

shows msgs not only [mta01.domains.com](http://mta01.domains.com), but also from other hosts and domains  
@source\_host:mta01.domain1.com (759) count per 30s | (759 hits)

still it shows not all messages, because search for '\*' show (9695 hits)

Searching for _@source\_host:_. **domain1**.com\* show 0 hits

# yum list installed | grep 'search'

elasticsearch.noarch 1.2.1-1 @elastic

============

I recovered old version of ES:

# yum list installed | egrep 'search|logstash'

elasticsearch.noarch 1.1.2-1 @elastic-1.1  
logstash.noarch 1.4.1-1\_bd507eb @logstash-1.4

and tested on the same time division

_@source\_host:mta01.domain1.com:_

shows msgs not only [mta01.domains.com](http://mta01.domains.com), but also from other hosts and domais  
@source\_host:mta01.domain1.com (31) count per 30s | (31 hits)

Searching of _@source\_host:_. **domain1**.com: \*gives 1116 hits and  
different hosts from [domain1.com](http://domain1.com) in output

Have I found a bug?

Can anyone reproduce that?

/Oleksandr

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/a63cac92-d544-4a2a-ae26-da945e403e3a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a63cac92-d544-4a2a-ae26-da945e403e3a%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:18am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-problems-with-queries-after-upgrade-to-es-1-2-1/18424/2 "2017-07-06T01:18:38Z")

</div>

Closed on July 6, 2017, 1:18am UTC