Elasticsearch v5 Alpha2
I'm noticing something bizarre while trying to search our cluster via API. It seems as if I include an uppercase character in my wildcard or regexp string, no results come back.. For example:
This works:
{
"query" : {
"bool" : {
"must" : {
"wildcard" : {
"message" : "*dapter*"
}
},
"filter" : {
"range" : {"@timestamp" : {"gte" : "now-15m"}}
}
}
}
}
This query yields results:
"hits": {
"total": 58,
"max_score": 1,
And I can see one of the results contains the message string:
<log realm=\"org.jpos.security.hsm.thales.ThalesAdapter\" at=\"Thu May 26 00:14:45.962 GMT+00:00 2016\" lifespan=\"23ms\">\n <trace>\n <elapsed-time>22ms</elapsed-time>\n </trace>\n</log>
However if I search for *Adapter*
instead of *dapter
in my query:
{
"query" : {
"bool" : {
"must" : {
"wildcard" : {
"message" : "*Adapter*"
}
},
"filter" : {
"range" : {"@timestamp" : {"gte" : "now-15m"}}
}
}
}
}
I get nothing:
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 9,
"successful": 9,
"failed": 0
},
"hits": {
"total": 0,
"max_score": null,
"hits": []
}
}
What am I missing?