New user looking to learn query syntax
looking to search on [ERROR] but whatever I tried returns Error as well.
Some of the things i tried I though would work.
message: [ERROR]
message: "[ERROR]"
message: "[ERROR]"
HI
If you would like to know more about query syntax, I would recommend this blog. It does give a good explanation of it...
and about your question:
it's probably because of the analyzer used on their message field, which is setup in the mappings by default a text field will use the standard analyzer, which will lower case everything so if the word "ERROR" or "Error" appear in their message, both will get normalized to "error" same for the query string itself, even though they're searching for "ERROR", it get's normalized to "error"
Thanks
Rashmi
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.