hi, I'm starting on DSL query...
I'm a little bit lost because as an example I try to match a very easy sample but I can't match...
Is somebody can help me ? the only answer I get (on elasticsearch Head) is the 10th first document of my index...
I have my message in this "root" : doc._source.message
example :
{
"took": 11,
"timed_out": false,
"_shards": {
"total": 3,
"successful": 3,
"skipped": 0,
"failed": 0},
"hits": {
"total": 1094542,
"max_score": 1,
"hits": [
{
"_index": "filebeat-2019.07.09",
"_type": "doc",
"_id": "xxxxxxxxxxxx",
"_score": 1,
"_source": {
"offset": 1082156,
"prospector": {
"type": "log"},
"source": "localhost_access_log.2019-07-09.txt",
"message": "- - - [09/Jul/2019:08:00:46 +0200] 302 - POST /xxxxxxx 66",
"http_verb": "POST",
"duration": 66,
"input": {
"type": "log"},
"time_request": "09/Jul/2019:08:00:46 +0200",
"@timestamp": "2019-07-08T06:00:46.000Z",
"application": "XXXX",
"host": {
"os": {
"codename": "Core",
"family": "redhat",
"version": "7 (Core)",
"platform": "centos"},
"containerized": true,
"name": "YYYYY",
"id": "123456789",
"architecture": "x86_64"},
"beat": {
"hostname": "YYYYY",
"name": "YYYYY",
"version": "6.5.1"},
"http_status": "302",
"http_bytes_sent": "-",
"http_request": "/xxxxxxxx",
"http_query_string": ""}},
{
"_index": "filebeat-2019.07.09",
"_type": "doc",
"_id": "123456789",
"_score": 1,
"_source": {
"remote_addr": "xx.xx.xx.xx",
"offset": 1082231,
"prospector": {
"type": "log"},
"source": "/path/localhost_access_log.2019-07-09.txt",
"message": "hello this my_string test",
"http_verb": "GET",
"duration": 39,
...
I tried this query and no success ! Here lmy tests :
test 1 :
{
"query": {
"query_string": {
"query": {
"match_phrase": {
"message": "my_string"
}
}
}
}
}
test 2 :
{
"query": { "match_phrase": { "message": "my_string" } }
}