Problems to search a entry

Elastic Stack Elasticsearch
1

HI Guys,

I have the following entry in ES:

   "_index" : "dcr_openet",
    "_type" : "dcr",
    "_id" : "rGntvmABbc4FmuhdAoi3",
    "_score" : null,
    "_source" : {
      "session" : "RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502",
      "rating_group" : 7,
      "msisdn" : 5122974444598,
      "productid" : 201505253108,
      "nme_total_octets_used" : 10091277,
      "nme_result_code" : 2001,
      "nme_starttime" : "2018-01-03T21:15:31",
      "nme_endtime" : "2018-01-03T23:38:35",
      "avp_charge_rule_base_name" : "",
      "avp_sgsn_mcc_mnc" : 72405,
      "avp_rat_type" : 1000,
      "filename" : "RTC_encfwapp8-oam_dcr_20180103_233247.091457.cdr"

I am trying to search this entry using the following syntax:

curl -s -POST 'localhost:9200/dcr_openet/_search?pretty' -H 'Content-Type: application/json' -d'
{
"query":{
"bool":{
"must":{
"match":{
"session":"RTC_encfwapp8-oam_dcr_20180103_233247.091457.cdr"
}
},
"filter":{
"range":{
"nme_endtime":{
"gte":"2018-01-03T00:00:00,
"lte":"2018-01-03T23:59:59"
}
}
}
}
},
"size":10000,
"sort": [
{"nme_endtime": {"order" : "asc"}}
]
}'

But no entries is found with this query.

Does anyone know how can i find this entry using session field as filter ?

Thanks

2

You are looking for RTC_encfwapp8-oam_dcr_20180103_233247.091457.cdr in the session field, but that is the value of the filename field. To find that document using the session field, you need to look for RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502 instead:

GET /dcr_openet/_search
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "session": "RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502"
        }
      },
      "filter": {
        "range": {
          "nme_endtime": {
            "gte": "2018-01-03T00:00:00",
            "lte": "2018-01-03T23:59:59"
          }
        }
      }
    }
  },
  "size": 10000,
  "sort": [
    {
      "nme_endtime": {
        "order": "asc"
      }
    }
  ]
}
3

You are completely right.

But i have tried again, now with correct session (RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502) , and the result was different than i was looking for. Follow bellow the result:

{
"took" : 3080,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 155572385,
"max_score" : null,
"hits" : [
{
"_index" : "dcr_openet",
"_type" : "dcr",
"_id" : "dVVrvGABbc4FmuhdD8ZT",
"_score" : null,
"_source" : {
"session" : "RJMTE01-LTE-Gx;145031771;1117857822;5a4c1222-1e02",
"rating_group" : 15,
"msisdn" : 5569991282653,
"productid" : 201609163128,
"nme_total_octets_used" : 0,
"nme_result_code" : 2001,
"nme_starttime" : "2018-01-02T21:13:38",
"nme_endtime" : "2018-01-03T11:52:03",
"avp_charge_rule_base_name" : "",
"avp_sgsn_mcc_mnc" : 72405,
"avp_rat_type" : 1000,
"filename" : "RTC_encfwapp5-oam_dcr_20180103_115203.091600.cdr"
},
"sort" : [
1514980323000
]

4

How has the session field been mapped? Is it a text or a keyword field? If you did not provide an explicit mapping for that field, you may want to try querying the session.keyword multifield instead:

GET /dcr_openet/_search
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "session.keyword": "RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502"
        }
      },
      "filter": {
        "range": {
          "nme_endtime": {
            "gte": "2018-01-03T00:00:00",
            "lte": "2018-01-03T23:59:59"
          }
        }
      }
    }
  },
  "size": 10000,
  "sort": [
    {
      "nme_endtime": {
        "order": "asc"
      }
    }
  ]
}
5

Abdon, perfect !!

Thanks so much !

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.