Position Data Error

Elastic Stack Kibana
1

I m using the following version of ES:

"name" : "dwh-edge001",
  "cluster_name" : "prod_dwh_expansion",
  "version" : {
    "number" : "2.3.1",
    "build_hash" : "bd980929010aef404e7cb0843e61d0665269fc39",
    "build_timestamp" : "2016-04-04T12:25:05Z",
    "build_snapshot" : false,
    "lucene_version" : "5.5.0"
  },
  "tagline" : "You Know, for Search"
}

Currently we are using templates to index our data:

{
  "template" : "fernando_test",
  "settings" : {
    "index.refresh_interval" : "5s",
    "index.routing.allocation.require.node_type": "hot",
    "analysis" : {
      "analyzer" : {
        "default" : {
          "type" : "standard",
          "stopwords" : "_none_"
        }
      }
    }
  },
  "mappings" : {
    "_default_" : {
      "_all" : {"enabled" : true},
      "dynamic_templates" : [ {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "multi_field",
            "fields" : {
              "{name}" : {"type": "string", "position_increment_gap": 0, "index" : "analyzed", "omit_norms" : true, "index_options" : "docs"}
            }
          }
        }
      } ],
      "properties" : {
        "@version": { "type": "string", "index": "not_analyzed" },
        "geoip"  : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "ip" : { "type": "ip" },
            "location" : { "type" : "geo_point" }
          }
        },
        "tags": { "type": "string", "index": "not_analyzed" },
        "pid": { "type": "long", "index": "not_analyzed" },
        "priority": { "type": "integer", "index": "not_analyzed" },
        "severity": { "type": "integer", "index": "not_analyzed" },
        "facility": { "type": "integer", "index": "not_analyzed" },
        "syslog_severity_code": { "type": "integer", "index": "not_analyzed" },
        "syslog_facility_code": { "type": "integer", "index": "not_analyzed" }
      }
    }
  }
}

So whenever I tried to visualize a hostname proxy001.sing1 for one of our indexes I get the following error in kibana:

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_state_exception","reason":"field \"beat.name\" was indexed without position data; cannot run PhraseQuery (phrase=beat.name:\"proxy001 sing1\")"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"fernando_test","node":"jPoFBJ9TT0eSSXEWIao0mQ","reason":{"type":"illegal_state_exception","reason":"field \"beat.name\" was indexed without position data; cannot run PhraseQuery (phrase=beat.name:\"proxy001 sing1\")"}}]}}

Any idea what Im doing wrong here.

2

Setting index_options to "docs" means that it does not support phrase queries. Perhaps there is some combination of query string options you could speficy in the query:queryString:options advanced setting

3

Ok , I think Im close to get what I need. So when I set change the config of index as not_analyzed in the fields portion now I can query the exact match. I want that whenever one of the fields is name hostname.

"fields" : {
"{name}" : {"type": "string", "position_increment_gap": 0, "index" : "not_analyzed", "omit_norms" : true, "index_options" : "docs"}

However whenever the field is called message I want to be analyzed is there a way to accomplish that.
Can I set it in the properties by:

"properties" : {
"@version": { "type": "string", "index": "not_analyzed" },
"message": { "type": "string", "index":"analyzed"},

4

Ok I this can be closed.
I manage to perfrom what I was looking for

"dynamic_templates" : [
{
"beat" : {
"path_match" : "beat.",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string",
"index" : "not_analyzed",
"omit_norms" : true,
"index_options" : "offsets"
}
}
},
{
"string_fields" : {
"match" : "",
"match_mapping_type" : "string",
"mapping" : {
"type" : "multi_field",
"fields" : {
"{name}" : {"type": "string", "index" : "analyzed", "omit_norms" : true, "index_options" : "offsets"}
}
}
}
} ],