Hi Amit,
You'll probably need to use a multi field
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/_multi_fields.html
(one with standard analyzer, one with keyword analyzer). This should return
the string on:
message:"string"
and
message.raw:"this.*string"
Best regards,
Radu
Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/
On Tue, Jan 6, 2015 at 10:44 AM, Amit amit.balode@gmail.com wrote:
The default analyzer is standard. If I change it to keyword I can get
regex
working. But I want both to work simultaneously.
For ex, Lets say I push this event to elasticsearch via logstash "this is
my
new string".
In kibana search,
If I look for message:"string", it should return me "this is my new
string"
If I look for message:"this.*string", it should return me "this is my new
string"--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
.
For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHXA0_1qaAWH08Q%2B36FYqmNJp_1A50MG3_-D8hPZMCRyeB08TA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.