I have some documents in a index..

"hits" : [
      {
        "_index" : "siem-referencedata-table-table2d526444eff99b1706053853ef7",
        "_type" : "_doc",
        "_id" : "0table222cc244b04b59d9ecafb0476e6",
        "_score" : 1.0,
        "_source" : {
          "column-name1" : "10.1.10.1",
          "column-name2" : "range(100,200)",
          "column-name3" : "nam3",
          "create_time" : "2022-05-21 03:30:39",
          "last_seen" : "2022-05-21 03:30:39",
          "id" : "0table222cc244b04b59d9ecafb0476e6"
        }
      },...

I want to search documents with three fields column-name1, column-name2 and column-name3. I use below query with term to search exact considered word:

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "column-name1": {"value":"10.1.10.1"}
          }
        },
        {
          "term": {
            "column-name2": {"value":"range(100,200)"}
          }
        },
        {
          "term": {
            "column-name3": {"value":"nam3"}
          }
        }
      ]
    }
  }
}

It works without "column-name2": {"value":"range(100,200)"}.. what should I do with range ability? Is there another way to handle this?

CodePudding user response：

The query solved with adding keyword to filed as below:

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "column-name1.keyword": {"value":"10.1.10.1"}
          }
        },
        {
          "term": {
            "column-name2.keyword": {"value":"range(100,200)"}
          }
        },
        {
          "term": {
            "column-name3.keyword": {"value":"nam3"}
          }
        }
      ]
    }
  }
}

Thank from Barkha Jain!