What's the difference between es's match search and luence search

[ocean_shi]

it's can get when i search use es match query.the match query is like

 {"query": 
    {
        "bool": {
       "must": [
          {
             "match": {
             "message": "too long"}
          }],
         "must_not": [ ],
     "should": [ ]}},
     "from": 0,
     "size": 10,
     "sort": [ ],
     "aggs": { }
}

but i can't get when i use luence query like "_search?q=message:"too long"&size=1000".

The content of "message" is "java.util.concurrent.TimeoutException: Remote system has been silent for too long. (more than 48.0 hours)".

but it's all can get when i search info "Remote system".

[Mark_Harwood]

Works for me here when I use the default mapping:

DELETE test
POST test/_doc/1
{
 "message":   "java.util.concurrent.TimeoutException: Remote system has been silent for too long. (more than 48.0 hours)"
}
GET test/_search?q=message:"too long"&size=1000

This matches the doc, as does the longer match query example you shared.
This is probably down to your mapping. Can you share your mapping configuration?

[ocean_shi]

thanks for you answer。
my mapping is

"mappings": {
"_default_": { "dynamic_templates": [ { "string_fields": { "mapping": { "type": "keyword"},"match_mapping_type": "string"}}],"_all": { "enabled": false},"properties": { "@timestamp": { "type": "date"},"message": { "norms": false,"similarity": "boolean","analyzer": "ik_max_word","type": "text"}}},
"doc": { "dynamic_templates": [ { "string_fields": { "mapping": { "type": "keyword"},"match_mapping_type": "string"}}],"_all": { "enabled": false},"properties": { "logType": { "type": "keyword"},"log": { "properties": { "file": { "properties": { "path": { "type": "keyword"}}},"offset": { "type": "long"}}},"index_day": { "type": "keyword"},"message": { "norms": false,"similarity": "boolean","analyzer": "ik_max_word","type": "text"},"subTaskId": { "type": "keyword"},"tags": { "type": "keyword"},"@timestamp": { "type": "date"},"logLevel": { "type": "keyword"},"@version": { "type": "keyword"},"host": { "properties": { "name": { "type": "keyword"}}},"taskName": { "type": "keyword"},"applicationId": { "type": "keyword"},"containerId": { "type": "keyword"},"fields": { "properties": { "clusterId": { "type": "long"}}}}}
}

[Mark_Harwood]

Thanks. You're using an analyzer called ik_max_word which I can't see and will be defined in your settings.
One of the ways of debugging this and other issues yourself is to use the _analyze api to see how the document and query is tokenized and the _explain API to show how a query does (or doesn't) match a doc.

[ocean_shi]

I try it,
The analyze is

{
    "tokens": [
        {
            "token": "too",
            "start_offset": 0,
            "end_offset": 3,
            "type": "ENGLISH",
            "position": 0
        },
        {
            "token": "long",
            "start_offset": 4,
            "end_offset": 8,
            "type": "ENGLISH",
            "position": 1
        }
    ]
}

the explain is

{
    "_index": "test",
    "_type": "_doc",
    "_id": "xHPL8nUBlF-KtMFxz-1J",
    "matched": false,
    "explanation": {
        "value": 0.0,
        "description": "Failure to meet condition(s) of required/prohibited clause(s)",
        "details": [
            {
                "value": 0.0,
                "description": "no match on required clause (message:\"too long\")",
                "details": [
                    {
                        "value": 0.0,
                        "description": "no matching phrase",
                        "details": []
                    }
                ]
            },
            {
                "value": 0.0,
                "description": "no match on required clause (MatchNoDocsQuery(\"Type list does not contain the index type\"))",
                "details": [
                    {
                        "value": 0.0,
                        "description": "MatchNoDocsQuery(\"Type list does not contain the index type\") doesn't match id 0",
                        "details": []
                    }
                ]
            }
        ]
    }
}

it's amazing that The content has “too long ” phrase.

[ocean_shi]

The analyze is

{
    "tokens": [
        {
            "token": "too",
            "start_offset": 0,
            "end_offset": 3,
            "type": "<ALPHANUM>",
            "position": 0
        },
        {
            "token": "long",
            "start_offset": 4,
            "end_offset": 8,
            "type": "<ALPHANUM>",
            "position": 1
        }
    ]
}

[Mark_Harwood]

Thanks. Can you share the full explain request which includes the query?

[ocean_shi]

Thanks.
The full explain request is

http://ip:port/test/_doc/xHPL8nUBlF-KtMFxz-1J/_explain?q=message:"too long"

My es version is 6.8

[Mark_Harwood]

It looks like your mapping declares a document type doc but your query url references the type _doc

[ocean_shi]

Sorry, the "_doc" is error. my type is "test",the data is like this:

I try request again, like this:

http://sloth0.dg.163.org:9201/test/test/xHPL8nUBlF-KtMFxz-1J/_explain?q=message:"too long"

The result is:

{
    "_index": "test",
    "_type": "test",
    "_id": "xHPL8nUBlF-KtMFxz-1J",
    "matched": false,
    "explanation": {
        "value": 0.0,
        "description": "no matching phrase",
        "details": []
    }
}

I also can't get more information

[Mark_Harwood]

My output from the analyze API is identical to yours and yet the query below works OK in 6.6. and 7.10.
Can you try run this and compare? Then try it using your Analyzer..

DELETE test
POST test/_doc/1
{
 "message":   "java.util.concurrent.TimeoutException: Remote system has been silent for too long. (more than 48.0 hours)"
}
GET test/_analyze
{
  "field": "message", 
  "text": "too long"
}
GET test/_doc/1/_explain?q=message:"too long"

[ocean_shi]

I have a try, the result is:

[Mark_Harwood]

Did my example (with the default analyzer) work?
What is the output of the analyze api using your analyzer and the string that is your document’s message?