ElasticSearch: Query post body not working but uri search working -
i sending following elastic-search query , behaves when sent via uri-search. post body call - doesn't work expected. kindly suggest how correct query.
this works:
get call
<someurl>/elasticsearch/index/_search?q=host:host-0
response (limited host-0)
{ "took": 4, "timed_out": false, "_shards": { "total": 5, "successful": 5, "failed": 0 }, "hits": { "total": 128040, "max_score": 2.0973763, "hits": [{ "_index": "123" "_type": "log_message", "_id": "123", "_score": 111, "_source": { "host": "host-0", "pid": 333, "timestamp": "2017-04-06t04:29:44.724z", "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, "_index": "345" "_type": "log_message", "_id": "345", "_score": 111, "_source": { "host": "host-0", "pid": 333, "timestamp": "2017-04-06t04:29:44.724z", "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, ..... }
this doesn't work:
post call
<someurl>/elasticsearch/index/_search
body post call:
{ "query" : { "term" : { "host": "host-0" } } }
response (does not limit host-0)
{ "took": 4, "timed_out": false, "_shards": { "total": 5, "successful": 5, "failed": 0 }, "hits": { "total": 128040, "max_score": 2.0973763, "hits": [{ "_index": "123" "_type": "log_message", "_id": "123", "_score": 111, "_source": { "host": "host-1", "pid": 333, "timestamp": "2017-04-06t04:29:44.724z", "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, "_index": "345" "_type": "log_message", "_id": "345", "_score": 111, "_source": { "host": "host-0", "pid": 333, "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, "_index": "546" "_type": "log_message", "_id": "546", "_score": 111, "_source": { "host": "host-0", "pid": 222, "priority": 7, "namespace": "syslog", "msg": "aaaaa" } }, ..... }
the on index returns /elasticsearch/
"host": { "type": "string", "index": "not_analyzed" },
in call, token host-0
analyzed. if try following call (by surrounding host-0
double quotes), you'll same query post call, , won't results.
<someurl>/elasticsearch/index/_search?q=host:"host-0"
if want results, need use match
query instead of term
one. equivalent ...?q=host:host-0
in call.
{ "query" : { "match" : { "host": "host-0" } } }
in end think host
field has text
type while should have keyword
type.
Comments
Post a Comment