# Problems to search a entry

**URL:** <https://discuss.elastic.co/t/problems-to-search-a-entry/114092>\
**Category:** Elasticsearch\
**Created:** [January 4, 2018, 1:16pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092 "2018-01-04T13:16:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Claudio\_Ract\_Costa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_ract_costa/32/26095_2.png) [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\
**Post date:** [January 4, 2018, 1:16pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092/1 "2018-01-04T13:16:38Z")

</div>

HI Guys,

I have the following entry in ES:

> ```
> "_index" : "dcr_openet",
> "_type" : "dcr",
> "_id" : "rGntvmABbc4FmuhdAoi3",
> "_score" : null,
> "_source" : {
> "session" : "RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502",
> "rating_group" : 7,
> "msisdn" : 5122974444598,
> "productid" : 201505253108,
> "nme_total_octets_used" : 10091277,
> "nme_result_code" : 2001,
> "nme_starttime" : "2018-01-03T21:15:31",
> "nme_endtime" : "2018-01-03T23:38:35",
> "avp_charge_rule_base_name" : "",
> "avp_sgsn_mcc_mnc" : 72405,
> "avp_rat_type" : 1000,
> "filename" : "RTC_encfwapp8-oam_dcr_20180103_233247.091457.cdr"
> 
> ```

I am trying to search this entry using the following syntax:

> curl -s -POST 'localhost:9200/dcr\_openet/\_search?pretty' -H 'Content-Type: application/json' -d'  
> {  
> "query":{  
> "bool":{  
> "must":{  
> "match":{  
> "session":"RTC\_encfwapp8-oam\_dcr\_20180103\_233247.091457.cdr"  
> }  
> },  
> "filter":{  
> "range":{  
> "nme\_endtime":{  
> "gte":"2018-01-03T00:00:00,  
> "lte":"2018-01-03T23:59:59"  
> }  
> }  
> }  
> }  
> },  
> "size":10000,  
> "sort": [  
> {"nme\_endtime": {"order" : "asc"}}  
> ]  
> }'

But no entries is found with this query.

Does anyone know how can i find this entry using session field as filter ?

Thanks

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [January 4, 2018, 1:45pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092/2 "2018-01-04T13:45:48Z")

</div>

You are looking for `RTC_encfwapp8-oam_dcr_20180103_233247.091457.cdr` in the `session` field, but that is the value of the `filename` field. To find that document using the `session` field, you need to look for `RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502` instead:

```
GET /dcr_openet/_search
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "session": "RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502"
        }
      },
      "filter": {
        "range": {
          "nme_endtime": {
            "gte": "2018-01-03T00:00:00",
            "lte": "2018-01-03T23:59:59"
          }
        }
      }
    }
  },
  "size": 10000,
  "sort": [
    {
      "nme_endtime": {
        "order": "asc"
      }
    }
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Claudio\_Ract\_Costa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_ract_costa/32/26095_2.png) [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\
**Post date:** [January 4, 2018, 2:30pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092/3 "2018-01-04T14:30:14Z")

</div>

You are completely right.

But i have tried again, now with correct session (RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502) , and the result was different than i was looking for. Follow bellow the result:

> {  
> "took" : 3080,  
> "timed\_out" : false,  
> "\_shards" : {  
> "total" : 5,  
> "successful" : 5,  
> "skipped" : 0,  
> "failed" : 0  
> },  
> "hits" : {  
> "total" : 155572385,  
> "max\_score" : null,  
> "hits" : [  
> {  
> "\_index" : "dcr\_openet",  
> "\_type" : "dcr",  
> "\_id" : "dVVrvGABbc4FmuhdD8ZT",  
> "\_score" : null,  
> "\_source" : {  
> "session" : "RJMTE01-LTE-Gx;145031771;1117857822;5a4c1222-1e02",  
> "rating\_group" : 15,  
> "msisdn" : 5569991282653,  
> "productid" : 201609163128,  
> "nme\_total\_octets\_used" : 0,  
> "nme\_result\_code" : 2001,  
> "nme\_starttime" : "2018-01-02T21:13:38",  
> "nme\_endtime" : "2018-01-03T11:52:03",  
> "avp\_charge\_rule\_base\_name" : "",  
> "avp\_sgsn\_mcc\_mnc" : 72405,  
> "avp\_rat\_type" : 1000,  
> "filename" : "RTC\_encfwapp5-oam\_dcr\_20180103\_115203.091600.cdr"  
> },  
> "sort" : [  
> 1514980323000  
> ]

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [January 4, 2018, 3:17pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092/4 "2018-01-04T15:17:39Z")

</div>

How has the `session` field been mapped? Is it a `text` or a `keyword` field? If you did not provide an explicit mapping for that field, you may want to try querying the `session.keyword` multifield instead:

```
GET /dcr_openet/_search
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "session.keyword": "RJMCJ04-LTE-Gx;980251386;147470533;5a4d6413-c502"
        }
      },
      "filter": {
        "range": {
          "nme_endtime": {
            "gte": "2018-01-03T00:00:00",
            "lte": "2018-01-03T23:59:59"
          }
        }
      }
    }
  },
  "size": 10000,
  "sort": [
    {
      "nme_endtime": {
        "order": "asc"
      }
    }
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Claudio\_Ract\_Costa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_ract_costa/32/26095_2.png) [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\
**Post date:** [January 4, 2018, 3:57pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092/5 "2018-01-04T15:57:55Z")

</div>

> [@abdon](#):
>
> session.keyword

Abdon, perfect !!

Thanks so much !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2018, 3:58pm UTC](https://discuss.elastic.co/t/problems-to-search-a-entry/114092/6 "2018-02-01T15:58:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.