Please format your code using </> icon as explained in this guide. It will make your post much more readable!
Or use markdown style like:
```c#
CODE HERE
```
This is the icon to use if you are not using markdown format:
There's a live preview panel for exactly this reasons.
Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.
Please update your post.
Thanks!
The first thing that I would check is the mapping for the Event field: I suspect it is mapped as a text datatype, meaning the input at index time is analyzed i.e. if the JSON document to be indexed has "CreateOrder" as a value for Event field, this will undergo analysis, and the resulting tokens from analysis will be stored in the inverted index. If no specific configuration has been given, this will use the Standard Analyzer.
The terms query is a terms-level query that does not analyze the query input. This means that the input to the query is not analyzed, and will be passed verbatim to look for matches against the Event field. The problem here however, is that if the Event field has been analyzed at index time, the query input will be compared against the tokens produced by analysis. Amongst other things, the Standard Analyzer lowercases tokens, so a terms-level query input that contains casing won't match against an analyzed field that has lowercased tokens.
If you've simply gone with the default mappings with Elasticsearch, the Event field will have been mapped as a multi_field, meaning there will be a sub field called Event.keyword in the mapping that is mapped as a keyword datatype. The keyword data type does not undergo analysis so a terms query against this field will work.