query string doesn't work in elasticsearch scan&scroll search

Question

When I tried:

curl -XPOST 'http://localhost:9200/index/type/_search?search_type=scan&scroll=2m' -d '{"query": {"match": {"host":"xxxx"}}}'

I got a scroll_id. Then I issued:

curl -XPOST 'http://localhost:9200/_search/scroll?scroll=1m&scroll_id=......'

but the response contains logs belonging to other host. Why and how to solve it?

Thanks alot

Geoff Wright · Accepted Answer · 2015-09-17 02:04:06Z

1

Try a term query instead of match:

{"query": {"term": {"host":"xxxx"}}}

This would look for the exact value instead of analyzing the value you have for xxxx and a discussion of the differences is: https://www.elastic.co/guide/en/elasticsearch/guide/current/term-vs-full-text.html

If that doesn't work, it could also be that the field is being analyzed, and the mapping would need to be updated as well. Can you share the mapping for the index and type: http://localhost:9200/index/_mapping/type/?pretty ?

edited Sep 17, 2015 at 2:04

answered Sep 17, 2015 at 1:52

Geoff Wright

18810 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

query string doesn't work in elasticsearch scan&scroll search

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related