ElasticSearch query using match or term? -
i use match query search field "syslog_5424"
{   "query":{     "filtered":{        "query":{"match":{"syslog5424_app":"e1c28ca3-dc7e-4425-ba14-7778f126bdd6"}}     }   } }   here query result:
{ took: 23, timed_out: false, -_shards: { total: 45, successful: 29, failed: 0 }, -hits: { total: 8340, max_score: 17.623652, -hits: [ -{ _index: "logstash-2014.12.16", _type: "applog", _id: "auptbuwksotkslj7c27d", _score: 17.623652, -_source: { message: "132 <14>1 2014-12-16t12:16:09.889089+00:00 loggregator e1c28ca3-dc7e-4425-ba14-7778f126bdd6 [app/0] - - platform's mbean server", @version: "1", @timestamp: "2014-12-16t12:16:10.127z", host: "9.91.32.178:33128", type: "applog", syslog5424_pri: "14", syslog5424_ver: "1", syslog5424_ts: "2014-12-16t12:16:09.889089+00:00", syslog5424_host: "loggregator", syslog5424_app: "e1c28ca3-dc7e-4425-ba14-7778f126bdd6", syslog5424_proc: "[app/0]", syslog5424_msg: "get platform's mbean server", syslog_severity_code: 5, syslog_facility_code: 1, syslog_facility: "user-level", syslog_severity: "notice", @source_host: "%{syslog_hostname}", @message: "%{syslog_message}" } },   ...
but when change "match" "term", got nothing. content of field syslog5424_app "e1c28ca3-dc7e-4425-ba14-7778f126bdd6", can't find using "term".any kind of advice good.
    {       "query":{         "filtered":{            "query":{"term":{"syslog5424_app":"e1c28ca3-dc7e-4425-ba14-7778f126bdd6"}}         }       }     }      
what analyser using on field syslog_5424?
if it's standard analyser data being broken down search terms. e.g. 
e1c28ca3-dc7e-4425-ba14-7778f126bdd6   is broken down into:
e1c28ca3 dc7e 4425 ba14 7778f126bdd6   when use match query, search string broken down - match made.
however when use term query, search string won't analysed. i.e. looking e1c28ca3-dc7e-4425-ba14-7778f126bdd6 in 5 individual terms - it's not going match.
so - recommendation update mapping use not_analyzed - wouldn't need part of uuid, turn off analysis field.
Comments
Post a Comment