Hello,
I
I'm trying to search servers names on "host" attribut on my logstash index
I'm searching on the Discover tab in Kibana.
When I tape sl00pm in the search bar I got No results found and when I add " * " and search for sl00pm* I got this :
I don't understand why.
But when I do the same manip on another server name slzq85 I got this :
And this is what I'm expecting.
Here is the definition of my Index on LogStash :
{
"logstash-2019.03.20": {
"aliases": {},
"mappings": {
"apache-access": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"message_field": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"index": "analyzed",
"omit_norms": true,
"type": "string"
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"raw": {
"ignore_above": 256,
"index": "not_analyzed",
"type": "string"
}
},
"index": "analyzed",
"omit_norms": true,
"type": "string"
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"date": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"host": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
},
"settings": {
"index": {
"refresh_interval": "5s",
"number_of_shards": "5",
"provided_name": "logstash-2019.03.20",
"creation_date": "1553036402235",
"number_of_replicas": "1",
"uuid": "mCSFLYGETPm6qbgOwShHog",
"version": {
"created": "5060399"
}
}
}
}
}
And the version :
version": {
"number": "5.6.3",
"lucene_version": "6.6.1"
},
Could you please tell me why my results aren't good?
I want to add that I'am using mapping types and having the same attribut in different mapping types of my Index but with the same definition as above
regards