Search exact keyword from ES

Hi,
I'm using the below query to search and fetch the latest 1 record from ES

GET indexname/_search
{
   "query": {
    "dis_max": {
      "queries": [
        { "match": { "data.target.sampler.keyword": "CPU" }},
        { "match": { "data.row.Hostname.keyword": "HOSTNAME-21" }},
        { "match": { "data.name.keyword": "Average_cpu" }}
      ]
    }
  },
   "size": 1,
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ]
}

but in result I'm getting different hostnames.. I expect the result to be only for the "data.row.Hostname.keyword" value

The dismal query matched one or more of the queries so there is no guarantee the middle one must match. How come you are not using a Boolean query on terms instead?

Hi,
Thanks for the response..

I tried bool must but no luck..

GET indexname/_search
{
   "_source": [ "data.row.Hostname", "data.row.PerUtili" ],
   "query": {
    "bool": {
		"must": [
		    { "match": { "data.target.sampler": "aaCPU" }},
		    { "match": {"data.row.Hostname": "HOSTNAME-21"}},
		    { "match": {"data.row.CPU": "Average_cpu"}}
      
		]
    }
  }, "size": 1,
    "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ]
}

Hi.. Used keyword in bool must query.. it works now.

thanks for your help :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.