Missing result when it terms contained dash

Elastic Stack Elasticsearch
1

I build a log server that store my logs in elasticsearch.

Every log object looks like this

Log
=============================================>
{ "space": "admin", "type": "error", "source": "lorem-aws", "message":
"lorem error", "timestamp": 1365061457090 }
<=============================================

Then I use this query to fetch logs based on some parameters.
Query
=============================================>
{
"query": {
"filtered": {
"filter": {
"and": [
{
"terms": {
"type": [
"error",
"notification",
"warning"
]
}
},
{
"terms": {
"source": [
"lorem-aws"
]
}
}
]
},
"query": {
"bool": {
"must": [
{
"field": {
"space": "admin"
}
},
{
"query_string": {
"query": "*",
"default_field": "message"
}
}
]
}
}
}
},
"sort": [
{
"timestamp": {
"order": "desc"
}
}
],
"size": 10,
"facets": {}
}
<=============================================

I found out that the return results of above query was missing all the log
which its source is exactly "lorem-aws".

But if I changed the terms of 'source` to ["lorem", "aws"], it can return
all the logs that its source contain either "lorem" or "aws",
but this is not what I want.

Am I doing something wrong? If so, how can I improve it?

Thanks

--kuno

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

The terms filter that contains "lorem-aws" doesn't analyze at query time.
So you search for lorem-aws
During indexing the field source is analyzed, so the tokens that end up
in the index are: lorem and aws (assuming you're using the default
analyzer). This results in the fact that the document isn't found. Tho fix
this you can do 2 things:

  1. In your mapping set the index option for field source to
    not_analyzed. This makes sure that lorem-aws is indexed as is and you
    will have a match on it when using the terms filter. Note: changing the
    index option of a field can only be done for new fields and requires
    re-indexing.
  2. Or replace the terms for the source field by a match query with
    operator set to and and wrap that in a query filter. Then at query time
    lorem-aws is expended to lorem and aws and therefor will match with
    the indexed tokens.

On 4 April 2013 10:20, Qing Guan neokuno@gmail.com wrote:

I build a log server that store my logs in elasticsearch.

Every log object looks like this

Log
=============================================>
{ "space": "admin", "type": "error", "source": "lorem-aws", "message":
"lorem error", "timestamp": 1365061457090 }
<=============================================

Then I use this query to fetch logs based on some parameters.
Query
=============================================>
{
"query": {
"filtered": {
"filter": {
"and": [
{
"terms": {
"type": [
"error",
"notification",
"warning"
]
}
},
{
"terms": {
"source": [
"lorem-aws"
]
}
}
]
},
"query": {
"bool": {
"must": [
{
"field": {
"space": "admin"
}
},
{
"query_string": {
"query": "*",
"default_field": "message"
}
}
]
}
}
}
},
"sort": [
{
"timestamp": {
"order": "desc"
}
}
],
"size": 10,
"facets": {}
}
<=============================================

I found out that the return results of above query was missing all the log
which its source is exactly "lorem-aws".

But if I changed the terms of 'source` to ["lorem", "aws"], it can return
all the logs that its source contain either "lorem" or "aws",
but this is not what I want.

Am I doing something wrong? If so, how can I improve it?

Thanks

--kuno

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
Met vriendelijke groet,

Martijn van Groningen

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.