Search query returns empty items after applying index template

I have applied the following index template for changing attribute type of LineNumber for sorting

{
      "index_patterns": ["elksearch*"],
      "settings": {
        "number_of_shards": 1
      },
      "mappings": {
        "_source": {
          "enabled": true
        },
        "properties": {
          "LineNumber": {
            "type": "integer"
          },
          "ThreadId": {
            "type": "integer"
          }
        }
      }
    }

After applying the index template, the following query does not return any items. Can you help me to understand the issue with the index template?

{
  "bool" : {
    "must" : [
      {
        "bool" : {
          "should" : [
            {
              "match" : {
                "Message" : {
                  "query" : "Entering OnCarrierIdReadStarted",
                  "operator" : "AND",
                  "prefix_length" : 0,
                  "max_expansions" : 50,
                  "fuzzy_transpositions" : true,
                  "lenient" : false,
                  "zero_terms_query" : "NONE",
                  "auto_generate_synonyms_phrase_query" : true,
                  "boost" : 1.0
                }
              }
            },
            {
              "match" : {
                "Message" : {
                  "query" : "Entered - Activity CarrierIdRead started for device CIDRW1",
                  "operator" : "AND",
                  "prefix_length" : 0,
                  "max_expansions" : 50,
                  "fuzzy_transpositions" : true,
                  "lenient" : false,
                  "zero_terms_query" : "NONE",
                  "auto_generate_synonyms_phrase_query" : true,
                  "boost" : 1.0
                }
              }
            },
            {
              "match" : {
                "Message" : {
                  "query" : "Exited - Activity CarrierIdRead started for device CIDRW1",
                  "operator" : "AND",
                  "prefix_length" : 0,
                  "max_expansions" : 50,
                  "fuzzy_transpositions" : true,
                  "lenient" : false,
                  "zero_terms_query" : "NONE",
                  "auto_generate_synonyms_phrase_query" : true,
                  "boost" : 1.0
                }
              }
            },
            {
              "match" : {
                "Message" : {
                  "query" : "Leaving OnCarrierIdReadStarted. Data - CarrierId read started",
                  "operator" : "AND",
                  "prefix_length" : 0,
                  "max_expansions" : 50,
                  "fuzzy_transpositions" : true,
                  "lenient" : false,
                  "zero_terms_query" : "NONE",
                  "auto_generate_synonyms_phrase_query" : true,
                  "boost" : 1.0
                }
              }
            }
          ],
          "adjust_pure_negative" : true,
          "boost" : 1.0
        }
      },
      {
        "range" : {
          "@timestamp" : {
            "from" : "2018-10-16T09:54:33.000Z",
            "to" : "2019-10-16T09:54:33.898Z",
            "include_lower" : true,
            "include_upper" : false,
            "boost" : 1.0
          }
        }
      }
    ],
    "adjust_pure_negative" : true,
    "boost" : 1.0
  }
}

The output of the above query is given below

{"took":786,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":24,"relation":"eq"},"max_score":null,"hits":[{"_index":"elksearch","_type":"_doc","_id":"E0XG020B-Snj_g9BUuWn","_score":null,"sort":[1565271923922]},{"_index":"elksearch","_type":"_doc","_id":"Zrng020BG__IxbRWc_-j","_score":null,"sort":[1565271923922]},{"_index":"elksearch","_type":"_doc","_id":"Iqb_020BgaBT3baS0Ffu","_score":null,"sort":[1565271923922]},{"_index":"elksearch","_type":"_doc","_id":"F0XG020B-Snj_g9BUuXo","_score":null,"sort":[1565271923923]},{"_index":"elksearch","_type":"_doc","_id":"Yrng020BG__IxbRWc_-P","_score":null,"sort":[1565271923923]},{"_index":"elksearch","_type":"_doc","_id":"I6b_020BgaBT3baS0Ffu","_score":null,"sort":[1565271923923]},{"_index":"elksearch","_type":"_doc","_id":"FUXG020B-Snj_g9BUuWn","_score":null,"sort":[1565271923929]},{"_index":"elksearch","_type":"_doc","_id":"EUXG020B-Snj_g9BUuWm","_score":null,"sort":[1565271923929]},{"_index":"elksearch","_type":"_doc","_id":"ZLng020BG__IxbRWc_-g","_score":null,"sort":[1565271923929]},{"_index":"elksearch","_type":"_doc","_id":"aLng020BG__IxbRWc_-u","_score":null,"sort":[1565271923929]},{"_index":"elksearch","_type":"_doc","_id":"IKb_020BgaBT3baS0Fft","_score":null,"sort":[1565271923929]},{"_index":"elksearch","_type":"_doc","_id":"Hqb_020BgaBT3baS0Fft","_score":null,"sort":[1565271923929]},{"_index":"elksearch","_type":"_doc","_id":"FkXG020B-Snj_g9BUuWn","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"EkXG020B-Snj_g9BUuWm","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"FEXG020B-Snj_g9BUuWn","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"Zbng020BG__IxbRWc_-g","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"Z7ng020BG__IxbRWc_-j","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"abng020BG__IxbRWc_-u","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"Iab_020BgaBT3baS0Fft","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"Jab_020BgaBT3baS0Ffu","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"H6b_020BgaBT3baS0Fft","_score":null,"sort":[1565338673520]},{"_index":"elksearch","_type":"_doc","_id":"GEXG020B-Snj_g9BUuXo","_score":null,"sort":[1565338673523]},{"_index":"elksearch","_type":"_doc","_id":"Y7ng020BG__IxbRWc_-P","_score":null,"sort":[1565338673523]},{"_index":"elksearch","_type":"_doc","_id":"JKb_020BgaBT3baS0Ffu","_score":null,"sort":[1565338673523]}]}}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.