Elasticsearch query string filter pattern

Question

I want to filter documents of the below kind with a elasticsearch query

 {
        "_index" : "logs-000001",
        "_type" : "_doc",
        "_id" : "GkA5koEBhT9d1rYBb7_e",
        "_score" : null,
        "_source" : {
          "timestamp" : 1656015577105,
          "message" : "2022-06-23 20:19:37 +0000 [info]: #0 Faraday error: logs.input.app1-7594a7072372481283701560b4efc07:578087ee41d47354bae68162e1490c434fcb68631eb42a6c2fae953aaae61831",
          "ingestionTime" : 1656015581351,
          "eventId" : "36930381429816247681747540585230094267893920556028395521",
          "logGroup" : "logs-release200",
          "logStream" : "logs/kinesis/964da56be54b47fda012669544502f4b"
        }
      }

Query I have come up with so far

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "default_field": "message",
            "query": "*[info]: #0 Faraday error:*"
          }
        }
      ]
    }
  }

I want to filter the query string for the particular message pattern. The query I have also brings other records that do not match the pattern. Any help in refining the query is appreciated. TIA

Sagar Patel · Accepted Answer · 2022-06-24 04:37:40Z

1

You can use match_phrase query of Elasticsearch for getting result where [info]: #0 Faraday error: match in message field.

{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "[info]: #0 Faraday error:"
          }
        }
      ]
    }
  }
}

Please note that i have removed * from start and end of your query.

answered Jun 24, 2022 at 4:37

Sagar Patel

5,5161 gold badge11 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Milen Georgiev · Accepted Answer · 2022-06-24 05:00:07Z

0

query_string is searching the fields using an analyzer, this is why you will have results that have partial match for any of the words. Also it ignores white spaces and some special symbols for the same reason - they are used to split the searched string into list of words to search for.

You could try using regex - it does not use analyzer so it should match your regex correctly

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "regexp": {
      "user.id": {
        "value": ".*[info]: #0 Faraday error:.*",
      }
    }
  }
}

answered Jun 24, 2022 at 5:00

Milen Georgiev

5223 silver badges13 bronze badges

Collectives™ on Stack Overflow

Elasticsearch query string filter pattern

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related