You should double check all docs actually have the srcPortMap field. It will only show as missing if the doc being evaluated does not have a value for the field.
But calculating this at index time will be much more efficient, as David suggested.
You should double check all docs actually have the srcPortMap field. It will only show as missing if the doc being evaluated does not have a value for the field.
But calculating this at index time will be much more efficient, as David suggested.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.