Elasticsearch with python: query specific field

Question

I'm using python's elasticsearch module to connect and search through my elasticsearch cluster.

In the cluster, one of the fields in my index is 'message' - I want to query my elastic, from python, for a specific value in this 'message' field.

Here is my basic search which simply returns all logs of a specific index.

    es = elasticsearch.Elasticsearch(source_cluster)
    doc = {
        'size' : 10000,
        'query': {
            'match_all' : {}
        }
    }
res = es.search(index='test-index', body=doc, scroll='1m')

How should I change this query in order to find all results with the word 'moved' in their 'message' field?

The equivalent query that does it from Kibana is:

_index:test-index && message: moved

Thanks,

Noam

Answer 1

You need to use the match query. Try this:

doc = {
    'size' : 10000,
    'query': {
        'match' : {
            'message': 'moved'
        }
    }
}