Strange Query DSL results

(Pawel) #1

I'm getting strange search result while searching apache logs:

GET /filebeat-6.3.0-2018.06.27/_search
"query": { "match": { "message": "/fonts/Roboto-Bold.ttf" } }
Result total is 88

GET /filebeat-6.3.0-2018.06.27/_search
"query": { "match": { "message": "s/fonts/Roboto-Bold.ttf" } }
Result total is 371
Second query is more detailed, so the number of results shold be the same or less, or I'm missing something obvious

(Thomas Neirynck) #2

hi @waitangi,

this seems more like an Elasticsearch question, but the match-query, how it is written here just will do a string match because it just has a single term.

Maybe you just have more documents that have a message field that match with s/fonts/Roboto-Bold.ttf iso /fonts/Roboto-Bold.ttf?

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.