Query returns non matching records

Hi ,

I am using the following query to identify log entries having the message "DeviceStatus changed to Idle" within a period. But the query also returns the following messages

"Module State is changed to idle ModuleName : PA Previous State Idle"
"Module State is changed to idle ModuleName : PM2 Previous State Idle"

"query": {
{ "match":{
"Message":"DeviceStatus changed to Idle"
{ "range":{

What changes should be made to get matching records?


note that the default operator for the match query is OR, see https://www.elastic.co/guide/en/elasticsearch/reference/7.3/query-dsl-match-query.html#query-dsl-match-query-boolean

If that is not your issue, please provide a fully reproducible example.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.