ElasticSearch query using match or term? -
i use match query search field "syslog_5424"
{ "query":{ "filtered":{ "query":{"match":{"syslog5424_app":"e1c28ca3-dc7e-4425-ba14-7778f126bdd6"}} } } }
here query result:
{ took: 23, timed_out: false, -_shards: { total: 45, successful: 29, failed: 0 }, -hits: { total: 8340, max_score: 17.623652, -hits: [ -{ _index: "logstash-2014.12.16", _type: "applog", _id: "auptbuwksotkslj7c27d", _score: 17.623652, -_source: { message: "132 <14>1 2014-12-16t12:16:09.889089+00:00 loggregator e1c28ca3-dc7e-4425-ba14-7778f126bdd6 [app/0] - - platform's mbean server", @version: "1", @timestamp: "2014-12-16t12:16:10.127z", host: "9.91.32.178:33128", type: "applog", syslog5424_pri: "14", syslog5424_ver: "1", syslog5424_ts: "2014-12-16t12:16:09.889089+00:00", syslog5424_host: "loggregator", syslog5424_app: "e1c28ca3-dc7e-4425-ba14-7778f126bdd6", syslog5424_proc: "[app/0]", syslog5424_msg: "get platform's mbean server", syslog_severity_code: 5, syslog_facility_code: 1, syslog_facility: "user-level", syslog_severity: "notice", @source_host: "%{syslog_hostname}", @message: "%{syslog_message}" } },
...
but when change "match" "term", got nothing. content of field syslog5424_app "e1c28ca3-dc7e-4425-ba14-7778f126bdd6", can't find using "term".any kind of advice good.
{ "query":{ "filtered":{ "query":{"term":{"syslog5424_app":"e1c28ca3-dc7e-4425-ba14-7778f126bdd6"}} } } }
what analyser using on field syslog_5424?
if it's standard analyser
data being broken down search terms. e.g.
e1c28ca3-dc7e-4425-ba14-7778f126bdd6
is broken down into:
e1c28ca3 dc7e 4425 ba14 7778f126bdd6
when use match query, search string broken down - match made.
however when use term query, search string won't analysed. i.e. looking e1c28ca3-dc7e-4425-ba14-7778f126bdd6
in 5 individual terms - it's not going match.
so - recommendation update mapping use not_analyzed
- wouldn't need part of uuid, turn off analysis field.
Comments
Post a Comment