Regexp/wildcard with slash in data does not work (ES 5.0)

Elastic Stack Elasticsearch
1

Created the index as follows:
--begin--
PUT testdeviceports
{
"mappings": {
"portinfo": {
"properties": {
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"Name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
}
}
}
}
}
--end--

Keyword is the type, and from what I've read, that should be right.

Now, when I query for something with a slash in the data with a wildcard or a regex in Kibana, I get NO results...

Name: GigabitEthernet1/*
None...

Name.keword: GigabitEthernet1/*
None

Name: GigabitEthernet1/*
None...

Name.keword: GigabitEthernet1/*
None

Leave off the slash, and query for:
Name: GigabitEthernet*

And I get LOADS of results...

Read the docs, and I'm either missing something, or this is indeed a bug. Came across another post where someone said they got it to work by escaping the / with FOUR 's... Still no joy...

ES 5.0 with X-Pack Centos 7

2

Weird... Just weird...

So I created this mapping:
{
"properties": {
"hostname": {
"type": "text",
"analyzer": "whitespace",
"fielddata": true
},
"Name": {
"type": "text",
"analyzer": "whitespace",
"fielddata": true
}
}
}

hostname I can search with a regex... Up to any special character.

HOWEVER... Name I cannot search... NONE... As a matter of fact, ANY field with a '/' in it, is unsearchable with the mapping above.

This is entirely un-intuitive... Someone needs to document the expected behavior of regex with the different analyzers... This is entirely unexpected.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.