ElasticSearch: Query post body not working but uri search working -
i sending following elastic-search query , behaves when sent via uri-search. post body call - doesn't work expected. kindly suggest how correct query.
this works:
get call
<someurl>/elasticsearch/index/_search?q=host:host-0 response (limited host-0)
{ "took": 4, "timed_out": false, "_shards": { "total": 5, "successful": 5, "failed": 0 }, "hits": { "total": 128040, "max_score": 2.0973763, "hits": [{ "_index": "123" "_type": "log_message", "_id": "123", "_score": 111, "_source": { "host": "host-0", "pid": 333, "timestamp": "2017-04-06t04:29:44.724z", "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, "_index": "345" "_type": "log_message", "_id": "345", "_score": 111, "_source": { "host": "host-0", "pid": 333, "timestamp": "2017-04-06t04:29:44.724z", "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, ..... } this doesn't work:
post call
<someurl>/elasticsearch/index/_search body post call:
{ "query" : { "term" : { "host": "host-0" } } } response (does not limit host-0)
{ "took": 4, "timed_out": false, "_shards": { "total": 5, "successful": 5, "failed": 0 }, "hits": { "total": 128040, "max_score": 2.0973763, "hits": [{ "_index": "123" "_type": "log_message", "_id": "123", "_score": 111, "_source": { "host": "host-1", "pid": 333, "timestamp": "2017-04-06t04:29:44.724z", "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, "_index": "345" "_type": "log_message", "_id": "345", "_score": 111, "_source": { "host": "host-0", "pid": 333, "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, "_index": "546" "_type": "log_message", "_id": "546", "_score": 111, "_source": { "host": "host-0", "pid": 222, "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, ..... } the on index returns /elasticsearch/
"host": { "type": "string", "index": "not_analyzed" },
in call, token host-0 analyzed. if try following call (by surrounding host-0 double quotes), you'll same query post call, , won't results.
<someurl>/elasticsearch/index/_search?q=host:"host-0" if want results, need use match query instead of term one. equivalent ...?q=host:host-0 in call.
{ "query" : { "match" : { "host": "host-0" } } } in end think host field has text type while should have keyword type.
Comments
Post a Comment