Multi-field search question?

ismailyenigul · March 6, 2013, 10:03am

Hello,

We are using elasticsearch to store logs.We created index for username,ip
and date.
We want to search users has the IP X.Y.Z.T between time1 and time2.
How can I achive this with elasticsearch? Which type of query should I use?
It would be great if you can provide me an example query

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

dadoonet · March 7, 2013, 9:10am

So, let's say you have documents like:

{
"username":"login",
"ip":"127.0.0.1",
"date":"2013-03-07"
}

Here is a full recreation Gist: Searching with IP address and dates (logs) · GitHub

Does it help?

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr | @scrutmydocs

Le 6 mars 2013 à 11:03, ismailyenigul@gmail.com a écrit :

Hello,

We are using elasticsearch to store logs.We created index for username,ip and date.
We want to search users has the IP X.Y.Z.T between time1 and time2.
How can I achive this with elasticsearch? Which type of query should I use?
It would be great if you can provide me an example query

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

ismailyenigul · March 19, 2013, 8:52am

Hi David,

It is exactly what I was looking for. Thanks for your help.
But I have another question. this query search only for IP and date.
Can you give me another example to search user,ip and date in a single
query. In general, How can I search more than three different field?

Thanks again.

2013/3/7 David Pilato david@pilato.fr

So, let's say you have documents like:

{
"username":"login",
"ip":"127.0.0.1",
"date":"2013-03-07"
}

Here is a full recreation Gist: Searching with IP address and dates (logs) · GitHub

Does it help?

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet https://twitter.com/dadoonet | @elasticsearchfrhttps://twitter.com/elasticsearchfr
| @scrutmydocs https://twitter.com/scrutmydocs

Le 6 mars 2013 à 11:03, ismailyenigul@gmail.com a écrit :

Hello,

We are using elasticsearch to store logs.We created index for username,ip
and date.
We want to search users has the IP X.Y.Z.T between time1 and time2.
How can I achive this with elasticsearch? Which type of query should I use?
It would be great if you can provide me an example query

Thanks.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US
.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

dadoonet · March 19, 2013, 6:15pm

If you need full text search, you should look at

HTH

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr | @scrutmydocs

Le 19 mars 2013 à 09:52, ismail yenigul ismailyenigul@gmail.com a écrit :

Hi David,

It is exactly what I was looking for. Thanks for your help.
But I have another question. this query search only for IP and date.
Can you give me another example to search user,ip and date in a single query. In general, How can I search more than three different field?

Thanks again.

2013/3/7 David Pilato david@pilato.fr
So, let's say you have documents like:

{
"username":"login",
"ip":"127.0.0.1",
"date":"2013-03-07"
}

Here is a full recreation Gist: Searching with IP address and dates (logs) · GitHub

Does it help?

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr | @scrutmydocs

Le 6 mars 2013 à 11:03, ismailyenigul@gmail.com a écrit :

Hello,

We are using elasticsearch to store logs.We created index for username,ip and date.
We want to search users has the IP X.Y.Z.T between time1 and time2.
How can I achive this with elasticsearch? Which type of query should I use?
It would be great if you can provide me an example query

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US.
To unsubscribe from this group and all its topics, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

ismailyenigul · March 20, 2013, 10:23pm

Hi David,

I do not need full text search. I just need to search in 3 fields
(username, ip and a date range(from, to)) in a single query.

Thanks

2013/3/19 David Pilato david@pilato.fr

If you need full text search, you should look at
Elasticsearch Platform — Find real-time answers at scale | Elastic

Elasticsearch Platform — Find real-time answers at scale | Elastic

Elasticsearch Platform — Find real-time answers at scale | Elastic

HTH

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet https://twitter.com/dadoonet | @elasticsearchfrhttps://twitter.com/elasticsearchfr
| @scrutmydocs https://twitter.com/scrutmydocs

Le 19 mars 2013 à 09:52, ismail yenigul ismailyenigul@gmail.com a écrit
:

Hi David,

It is exactly what I was looking for. Thanks for your help.
But I have another question. this query search only for IP and date.
Can you give me another example to search user,ip and date in a single
query. In general, How can I search more than three different field?

Thanks again.

2013/3/7 David Pilato david@pilato.fr

So, let's say you have documents like:

{
"username":"login",
"ip":"127.0.0.1",
"date":"2013-03-07"
}

Here is a full recreation Gist: Searching with IP address and dates (logs) · GitHub

Does it help?

--
David Pilato | Technical Advocate | *Elasticsearch.com http://elasticsearch.com/
*
@dadoonet https://twitter.com/dadoonet | @elasticsearchfrhttps://twitter.com/elasticsearchfr
| @scrutmydocs https://twitter.com/scrutmydocs

Le 6 mars 2013 à 11:03, ismailyenigul@gmail.com a écrit :

Hello,

We are using elasticsearch to store logs.We created index for username,ip
and date.
We want to search users has the IP X.Y.Z.T between time1 and time2.
How can I achive this with elasticsearch? Which type of query should I
use?
It would be great if you can provide me an example query

Thanks.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US
.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US
.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

dadoonet · March 21, 2013, 7:37am

Just add a new clause in the Gist I already provided.

Do you have anything you don't understand in the Gist?

--
David
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 20 mars 2013 à 23:23, ismail yenigul ismailyenigul@gmail.com a écrit :

Hi David,

I do not need full text search. I just need to search in 3 fields (username, ip and a date range(from, to)) in a single query.

Thanks

2013/3/19 David Pilato david@pilato.fr

If you need full text search, you should look at
Elasticsearch Platform — Find real-time answers at scale | Elastic
Elasticsearch Platform — Find real-time answers at scale | Elastic
Elasticsearch Platform — Find real-time answers at scale | Elastic

HTH

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr | @scrutmydocs

Le 19 mars 2013 à 09:52, ismail yenigul ismailyenigul@gmail.com a écrit :

Hi David,

It is exactly what I was looking for. Thanks for your help.
But I have another question. this query search only for IP and date.
Can you give me another example to search user,ip and date in a single query. In general, How can I search more than three different field?

Thanks again.

2013/3/7 David Pilato david@pilato.fr

So, let's say you have documents like:

{
"username":"login",
"ip":"127.0.0.1",
"date":"2013-03-07"
}

Here is a full recreation Gist: Searching with IP address and dates (logs) · GitHub

Does it help?

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr | @scrutmydocs

Le 6 mars 2013 à 11:03, ismailyenigul@gmail.com a écrit :

Hello,

We are using elasticsearch to store logs.We created index for username,ip and date.
We want to search users has the IP X.Y.Z.T between time1 and time2.
How can I achive this with elasticsearch? Which type of query should I use?
It would be great if you can provide me an example query

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US.
To unsubscribe from this group and all its topics, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US.
To unsubscribe from this group and all its topics, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.