Simple Query on Discover Tab not Working

Elastic Stack Kibana
1

Newbie question here. I am sure I am missing something but I’m at a loss to understand what. I am trying to filter data on the Discover tab. I have a field called “groupname” with the following definition:

"groupname":{"index":"not_analyzed","type":"string"}

If I enter a simple query such as “groupname: SMS”, my records are filtered as expected, and SMS is highlighted in my view. But, if I enter the query “groupname: SMS OR STORAGE” or "groupname: SMS STORAGE", I get a mix of records, containing groupname values beyond SMS or STORAGE. Also, SMS is highlighted but STORAGE is not. Note that I am searching for the full value in the same case, and not a substring.

If I employ the same syntax on fields that are analyzed, everything works as expected.
My understanding was that fields that aren’t analyzed are still searchable. What am I doing wrong?

Thanks in advance.

Mark

2

What's likely happening on analyzed fields is it's parsing out your entire search string and matching on the words "SMS "OR" and "STORAGE" for each field. If the field's not analyzed it will try and match directly, so you'll want to search for these separately. groupname:SMS OR groupname:STORAGE.

3

That worked. Thank you for the explanation.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.