I'm not able any more to find some documents in the indices.
There are some documents having this field and value : "source" : "spectre_supEvt".
But a query in ElasticSearch filtering on the field and value return nothing (they used to return the documents). It was returning some the documents in the past, and those documents are still in the indices.
This problem is making me me mad !
See the details of the problem below, with the requests and incoherent responses I'm getting.
I'm using ElasticSearch version: 5.6.3, build: 1a2f265/2017-10-06T20:33:39.012Z, and JVM: 1.8.0_172.
Do you have an idea of the origin of the problem, and how I can solve it ?
Here are the request and the erroneous response :
curl -X GET http://ip:9200/graylog_5/_search?pretty=true -d '
{
"query": {
"term": { "source": "spectre_supEvt" }
},
"size": 1
}'
returns :
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 4,
"successful" : 4,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [ ]
}
}
We can check that there are some matching documents using the following request.
The response contains this field : "source" : "spectre_supEvt"
curl -X GET http://ip:9200/graylog_5/_search?pretty=true -d '
{
"query": {
"term": { "sysSourceId": "MDC" }
},
"size": 1
}'
returns :
{
"took" : 679,
"timed_out" : false,
"_shards" : {
"total" : 88,
"successful" : 88,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 31959030,
"max_score" : 0.34491536,
"hits" : [
{
"_index" : "graylog_5",
"_type" : "message",
"_id" : "0673b150-caca-11e8-8f2c-0600ea37eac6",
"_score" : 0.34491536,
"_source" : {
"sysSourceId" : "MDC",
"source" : "spectre_supEvt",
...
}
}
]
}
}
We can check that the problem is not caused by the "source" field name, using another value in the request :
curl -X GET http://ip:9200/graylog_5/_search?pretty=true -d '
{
"query": {
"term": { "source": "spectre" }
},
"size": 1
}'
returns :
{
"took" : 8,
"timed_out" : false,
"_shards" : {
"total" : 4,
"successful" : 4,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 341563,
"max_score" : 4.075432,
"hits" : [
{
"_index" : "graylog_5",
"_type" : "message",
"_id" : "5593a6d0-cb67-11e8-8f2c-0600ea37eac6",
"_score" : 4.075432,
"_source" : {
"source" : "spectre",
...
}
}
]
}
}