In my Elastic search pulled data, I am getting an ignored tag in the hits but yet the data is coming correctly... so what does that ignored tag mean?
{
"took": 9,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 10000,
"relation": "gte"
},
"max_score": 1,
"hits": [
{
"_index": "logstash_itsm_incidents_parent",
"_id": "VsiM54oBgsvS-hWrH3LY",
"_score": 1,
"_ignored": [
"recommendations.keyword",
"description.keyword",
"transactions.recommendations.keyword"
],
"_source": {
"case": {
"device_id": "SG28K2G001",
"alert_id": "",
"task_id": "CS0024396",
"state": "New",
"case_number": "CS0024396",
"configuration_item": "8400",
"device_name": "switch",
"ticket_classification": "Proactive"
},
"transactions": {
"reporting_sensor_count": 0,
"impacted_device_count": 1,
"asset_serial_number": "SG28K2G001",
"recommendations": [
"Login to the Switch and check the “show logging” to check for any errors relating to BGP",
"""Check if all the BGP neighborships are Established by using “show bgp ipv4 unicast summary”
a. If the neighborship status is anything apart from “established”, inform the customer and open a ticket with TAC with the outputs (show run / show tech bgp / show logging / show system resource-utilization(this is to check if the neighborship failed due to high CPU utilization))""",
"""Check the Uptime of the neighborship to check for any flaps in connection.
a. A flap can be identified by looking at the “Conn. Dropped” field in the output of “show bgp ipv4 unicast neighbor <IP address>”
b. If the flap is frequent inform customer of an unstable connection"""
]
},
"incident_number": "INC0092815",
"incident_parent_id": null,
"site_id": "ACCT0027558",
"short_description": "NAE status reached or exceeds the desired severity level for the switch SG28K2G001, Issue: Route Count",
"state": "Closed",
"updated_at": "2023-03-24T04:47:27.000Z",
"asset_serial_number": "SG28K2G001",
"sub_site_id": "ACCT0027777",
"@timestamp": "2023-09-30T19:06:55.116902Z",
"@version": "1",
"account_id": "ACCT0027554",
"case_number": [
{
"device_id": "SG28K2G001",
"alert_id": "",
"task_id": "CS0024396",
"state": "New",
"case_number": "CS0024396",
"configuration_item": "8400",
"device_name": "switch",
"ticket_classification": "Proactive"
}
],
"closed_at": "2023-03-31T05:00:02.000Z",
"index": "customerdata_incident",
"task_id": "INC0092815",
"sub_account_id": "ACCT0027557",
"tasks": {
"task_number": "INC0092815",
"task_type": "incident"
},
"description": "Aggregated NAE status reached or exceeds the desired severity level for the switch with serial SG28K2G001 MAC address ec:02:73:96:4c:00 IP address 10.10.20.101 and Hostname 8400X Event|5511|LOG_WARN|AMM|-|Current route count 5500 is outside lower threshold boundary of 7500 occured at 2021-09-01 04:56:09 UTC occured at 2023-03-17 10:41:10 UTC",
"case_number_id": "CS0024396",
"recommendations": """Login to the Switch and check the “show logging” to check for any errors relating to BGP,Check if all the BGP neighborships are Established by using “show bgp ipv4 unicast summary”
a. If the neighborship status is anything apart from “established”, inform the customer and open a ticket with TAC with the outputs (show run / show tech bgp / show logging / show system resource-utilization(this is to check if the neighborship failed due to high CPU utilization)),Check the Uptime of the neighborship to check for any flaps in connection.
a. A flap can be identified by looking at the “Conn. Dropped” field in the output of “show bgp ipv4 unicast neighbor <IP address>”
b. If the flap is frequent inform customer of an unstable connection"""
}
},
In the above, I am getting recommendations and description in the output... but it shows as ignored in the hits tags... Explain why?
