Update mapping and search on fields by wildcards

Hi pals,

I am using the APM. I have added the fields context.request.body and context.response.body to the indices in the .Net Core version (since the version I was using was not set for these fields, I added them myself, due to emergency). Unfortunately, I could not search on them, thus, updated the mapping. The mapping before I update it, was like (I have reduced many parts):

{
	"apm-6.5.4-metric-2020.03.15": {
		"mappings": {
			"doc": {
				"_meta": {
					"version": "6.5.4"
				},
				"properties": {
					"@timestamp": {
						"type": "date"
					},
					"context": {
						"dynamic": "false",
						"properties": {
							"request": {
								"properties": {
									"http_version": {
										"type": "keyword",
										"ignore_above": 1024
									},
									"method": {
										"type": "keyword",
										"ignore_above": 1024
									},
									"url": {
										"properties": {
											"full": {
												"type": "keyword",
												"ignore_above": 1024
											},
											"pathname": {
												"type": "keyword",
												"ignore_above": 1024
											}
										}
									}
								}
							},
							"response": {
								"properties": {
									"finished": {
										"type": "boolean"
									},
									"status_code": {
										"type": "long"
									}
								}
							}
							.
							.
							.
						}
					}
				}
			}
		}
	}
}

Then I added the following:

PUT /apm-6.5.4-transaction-2020.04.06/_mapping/doc
{
	"properties": {
		"context": {
			"type": "object",
			"properties": {
				"response": {
					"type": "object",
					"properties": {
						"body": {
							"type": "text"
						}
					}
				}
			}
		}
	}
}

and

PUT /apm-6.5.4-transaction-2020.04.06/_mapping/doc
{
	"properties": {
		"context": {
			"type": "object",
			"properties": {
				"request": {
					"type": "object",
					"properties": {
						"body": {
							"type": "text"
						}
					}
				}
			}
		}
	}
}

Then I refreshed the field list in Kibana.
Now, I want to search on the context.request.body or context.request.request, but I receive no result. A sample of the data in the index for context.request.request is

context.request.request:
{
	"id": "some guid", "user": {"id": "some guid", "firstname": "john", "lasname": "smith"},
}

The following is a sample of my query:

{
  "query": {
    "wildcard": {
      "context.request.body": {
        "value": "*john*"
      }
    }
  }
}

Could you please help me to edit my mapping or my query?! What is the problem?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.