# Query text which starting with slash by ElasticSearch 6.4.3

**URL:** <https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892>\
**Category:** Elasticsearch\
**Created:** [March 19, 2019, 4:30am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892 "2019-03-19T04:30:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chia-Wen\_Wu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chia-wen_wu/32/42283_2.png) [@Chia-Wen\_Wu](https://discuss.elastic.co/u/Chia-Wen_Wu)\
**Post date:** [March 19, 2019, 4:30am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/1 "2019-03-19T04:30:24Z")

</div>

Hi all,  
Here is my data structure in Elasticsearch

```auto
{
  "took" : 13,
  "timed_out" : false,
  "_shards" : {
    "total" : 4,
    "successful" : 4,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 5.7112346,
    "hits" : [
      {
        "_index" : "psql-widget-raw-log-2019.03",
        "_type" : "fluentd",
        "_id" : "33590",
        "_score" : 5.7112346,
        "_source" : {
          "id" : 33590,
          "domain_info_id" : 1,
          "path_string" : "/test.html?p1=aaa&p2=bbb",
          "user_group_id" : "gid01",
          "user_id" : "uid-01",
          "ctime" : "2019-03-19 02:29:15.026200+0000",
          "@timestamp" : "2019-03-19T10:29:15.000000000+08:00"
        }
      }
    ]
  }
}

```

And I wanna get data which path\_string is starting with "/test.html",

I've been tried prefix, wildcard , escaping slash,  
but it's seems not working.

I can only get data by match

Any help would be greatly appreciated

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 19, 2019, 7:14am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/2 "2019-03-19T07:14:26Z")

</div>

What is the mapping?

BTW, not sure what your usecase is but may be you'd like to look at the path tokenizer.

---

<div class="post-metadata">

**Author:** ![Chia-Wen\_Wu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chia-wen_wu/32/42283_2.png) [@Chia-Wen\_Wu](https://discuss.elastic.co/u/Chia-Wen_Wu)\
**Post date:** [March 19, 2019, 8:00am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/3 "2019-03-19T08:00:02Z")

</div>

Thanks, @dadoonet

Here is my mapping

```auto
PUT /_template/psql-widget-raw-log-format
{
  "index_patterns" : ["psql-widget-raw-log-*"],
   "settings":{  
    "number_of_shards": 2
   },
  "mappings": {
    "fluentd":{
        "properties":{
            "id":{
                "type":"integer"
            },
            "domain_info_id":{
                "type":"integer"
            }
        }
    }
  }
}

```

Usecase is like this in sql

select count(\*) from psql-widget-raw-log where path\_string like '/test.html%'

I still couldn't query by prefix, wildcard, regexp after changed value in field from '/test.html' to '%2Ftest.html' ( or '%2Ftest.html', '\%2Ftest.html')

It's worked when using other field like 'user\_group\_id' or 'user\_id', so I thought that I querying it in right way

Thanks for your help

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 19, 2019, 8:24am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/4 "2019-03-19T08:24:20Z")

</div>

I'd use a path tokenizer. See [https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-pathhierarchy-tokenizer.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-pathhierarchy-tokenizer.html)

---

<div class="post-metadata">

**Author:** ![Chia-Wen\_Wu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chia-wen_wu/32/42283_2.png) [@Chia-Wen\_Wu](https://discuss.elastic.co/u/Chia-Wen_Wu)\
**Post date:** [March 19, 2019, 9:35am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/5 "2019-03-19T09:35:48Z")

</div>

So I should change my mapping like this

```auto
PUT /_template/psql-widget-raw-log-format
{
  "index_patterns" : ["psql-widget-raw-log-*"],
   "settings":{  
    "number_of_shards": 2
   },
  "mappings": {
    "fluentd":{
        "properties":{
            "id":{
                "type":"integer"
            },
            "domain_info_id":{
                "type":"integer"
            },
            "path_string":{
                "type": "string",
                "analyzer":{"tokenizer": "path_hierarchy"} 
            }
        }
    }
  }
}

```

and then using query like this

```auto
curl -X GET "localhost:9200/psql-widget-raw-log-*/_search?pretty" -H 'Content-Type: application/json' -d'
{
    "query": {
        "bool": {
            "must": [
                {"prefix": {"path_string": "/test.html"}} 
            ],
            "filter":[ 
                {"range" : 
                    {"@timestamp" : 
                        {"gte" : "2019-03-19T10:00:00","lte" : "2019-03-20T00:59:59",
                        "time_zone": "+08:00"}
                    }
                },
                {"match": {"domain_info_id": "1"}}
            ]
        }
    }
}'

```

and get all data that path\_string is starting with "/test.html", e.q. "/test.html%3Fa%3Dthanku", "/test.html",....etc

Is this correct?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 19, 2019, 9:58am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/6 "2019-03-19T09:58:09Z")

</div>

Not exactly. You need to define an analyzer first. Then use the analyzer in your mapping.  
Then you can try just with a `term` or `match` query instead of a `prefix` query.

If you need further help, please provide a full recreation script as described in [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2019, 10:05am UTC](https://discuss.elastic.co/t/query-text-which-starting-with-slash-by-elasticsearch-6-4-3/172892/7 "2019-04-16T10:05:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.