Recommended field types for writing detections on with lucene

Elastic Security
1

Hey!

What are the recommended types of fields to write detections on with lucene?
I want my queries to be case insensitive but still perform exact matching and wildcarding.

Searching on text fields with wildcards produced some strange results in both ways it matched things that it shouldn't have and also missed things.

Thanks in advance!

2

Hello !

I think in your case "text" data type should do the work.

Can you paste the query you are trying to execute and a sample of anonymized data ? Maybe it's only an issue with syntax in the query.

Best regards !

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.