Elasticsearch query string filter pattern-CodePudding

I want to filter documents of the below kind with a elasticsearch query

 {
        "_index" : "logs-000001",
        "_type" : "_doc",
        "_id" : "GkA5koEBhT9d1rYBb7_e",
        "_score" : null,
        "_source" : {
          "timestamp" : 1656015577105,
          "message" : "2022-06-23 20:19:37  0000 [info]: #0 Faraday error: logs.input.app1-7594a7072372481283701560b4efc07:578087ee41d47354bae68162e1490c434fcb68631eb42a6c2fae953aaae61831",
          "ingestionTime" : 1656015581351,
          "eventId" : "36930381429816247681747540585230094267893920556028395521",
          "logGroup" : "logs-release200",
          "logStream" : "logs/kinesis/964da56be54b47fda012669544502f4b"
        }
      }

Query I have come up with so far

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "default_field": "message",
            "query": "*[info]: #0 Faraday error:*"
          }
        }
      ]
    }
  }

I want to filter the query string for the particular message pattern. The query I have also brings other records that do not match the pattern. Any help in refining the query is appreciated. TIA

CodePudding user response：

You can use match_phrase query of Elasticsearch for getting result where [info]: #0 Faraday error: match in message field.

{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "[info]: #0 Faraday error:"
          }
        }
      ]
    }
  }
}

Please note that i have removed * from start and end of your query.

CodePudding user response：

query_string is searching the fields using an analyzer, this is why you will have results that have partial match for any of the words. Also it ignores white spaces and some special symbols for the same reason - they are used to split the searched string into list of words to search for.

You could try using regex - it does not use analyzer so it should match your regex correctly

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "regexp": {
      "user.id": {
        "value": ".*[info]: #0 Faraday error:.*",
      }
    }
  }
}