CODEWITHSUNDEEP
elasticsearchluceneelasticsearch-2.0elasticsearch-query
thomas
thomas

Reputation: 310

Search Elasticsearch 2.4 if a field contains some particular string

Used elasticsearch version 2.4.1, lucene version 5.5.2.

Issue I am facing is I am having documents like below:

{
                "_index": "_myIndex",
                "_type": "_mytype",
                "_id": "76be12a4-037d-45e2-8941-8228287fcae4",
                "_source": {
                    "eventID": "76be12a4-037d-45e2-8941-8228287fcae4",
                    "receivedTimestamp": 1497591418899,
                    "producerName": "_myProducer",
                    "eventName": "event1",
                    "message": "This is a query regarding elasticsearch. Return me this document if it contains elasticsearch",
                    "timestamp": "1497591418000"
                }
}

When I search using below query I don't get the document instead I see

curl -XGET 'http://localhost:9200/_myIndex/_search?pretty' -H 'Content-Type: application/json' -d '{ "query": { "match": { "message": "elasticsearch" }}}'

Returns:
{
  "took" : 8,
  "timed_out" : false,
  "_shards" : {
    "total" : 10,
    "successful" : 10,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

Any help would be appreciated. I am newbie to Elasticsearch.

The mapping of the index:

{
    "_myIndex": {
        "mappings": {
            "_myType": {
                "properties": {
                    "eventID": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "eventName": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "message": {
                        "type": "string",
                        "index": "no"
                    },
                    "producerName": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "query": {
                        "properties": {
                            "bool": {
                                "properties": {
                                    "must": {
                                        "properties": {
                                            "range": {
                                                "properties": {
                                                    "timestamp": {
                                                        "properties": {
                                                            "gte": {
                                                                "type": "string"
                                                            },
                                                            "lt": {
                                                                "type": "string"
                                                            }
                                                        }
                                                    }
                                                }
                                            },
                                            "term": {
                                                "properties": {
                                                    "eventName": {
                                                        "properties": {
                                                            "value": {
                                                                "type": "string"
                                                            }
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    },
                    "receivedTimestamp": {
                        "type": "long"
                    },
                    "size": {
                        "type": "long"
                    },
                    "timestamp": {
                        "type": "long"
                    }
                }
            }
        }
    }
}

Upvotes: 0

Views: 100

Answers (1)

Val
Val

Reputation: 217304

The problem lies in the fact that your message field is not indexed ("index": "no"), hence not searchable.

You need to delete your index, then modify your message field mapping to the mapping below, then reindex your data and it will work.

                "message": {
                    "type": "string"
                },

Upvotes: 1

Related Questions