Update mapping and search on fields by wildcards

Elastic Stack Elasticsearch
1

Hi pals,

I am using the APM. I have added the fields context.request.body and context.response.body to the indices in the .Net Core version (since the version I was using was not set for these fields, I added them myself, due to emergency). Unfortunately, I could not search on them, thus, updated the mapping. The mapping before I update it, was like (I have reduced many parts):

{
	"apm-6.5.4-metric-2020.03.15": {
		"mappings": {
			"doc": {
				"_meta": {
					"version": "6.5.4"
				},
				"properties": {
					"@timestamp": {
						"type": "date"
					},
					"context": {
						"dynamic": "false",
						"properties": {
							"request": {
								"properties": {
									"http_version": {
										"type": "keyword",
										"ignore_above": 1024
									},
									"method": {
										"type": "keyword",
										"ignore_above": 1024
									},
									"url": {
										"properties": {
											"full": {
												"type": "keyword",
												"ignore_above": 1024
											},
											"pathname": {
												"type": "keyword",
												"ignore_above": 1024
											}
										}
									}
								}
							},
							"response": {
								"properties": {
									"finished": {
										"type": "boolean"
									},
									"status_code": {
										"type": "long"
									}
								}
							}
							.
							.
							.
						}
					}
				}
			}
		}
	}
}

Then I added the following:

PUT /apm-6.5.4-transaction-2020.04.06/_mapping/doc
{
	"properties": {
		"context": {
			"type": "object",
			"properties": {
				"response": {
					"type": "object",
					"properties": {
						"body": {
							"type": "text"
						}
					}
				}
			}
		}
	}
}

and

PUT /apm-6.5.4-transaction-2020.04.06/_mapping/doc
{
	"properties": {
		"context": {
			"type": "object",
			"properties": {
				"request": {
					"type": "object",
					"properties": {
						"body": {
							"type": "text"
						}
					}
				}
			}
		}
	}
}

Then I refreshed the field list in Kibana.
Now, I want to search on the context.request.body or context.request.request, but I receive no result. A sample of the data in the index for context.request.request is

context.request.request:
{
	"id": "some guid", "user": {"id": "some guid", "firstname": "john", "lasname": "smith"},
}

The following is a sample of my query:

{
  "query": {
    "wildcard": {
      "context.request.body": {
        "value": "*john*"
      }
    }
  }
}

Could you please help me to edit my mapping or my query?! What is the problem?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.