I have a field as
author
Jason Pete
Jason Paul
Mike Yard
Jason Voorhies
in kibana 4.4 i am querying as
author:/Jason.*/
so i get all records for
Jason Pete
Jason Paul
Jason Voorhies
fine, now i want to do
author:/Jason P.*/
i expect
Jason Pete
Jason Paul
but i get
No Records found :(
what is wrong with my regex? Is there another way to specify the space character after Jason? I even tried
author:/Jason\sP.*/
but still no results
This is because your author
field is probably analyzed, and thus, the value Jason Pete
gets tokenized into two tokens jason
and pete
. Hence, it is not possible to query both values.
If you want to change that behavior, I suggest you create a multi-field out of the author
field, with a not_analyzed
sub-field, like this:
curl -XPUT localhost:9200/my_index/_mapping/my_type -d '{
"my_type": {
"properties": {
"author": {
"type": "string",
"fields": { <--- add this section to author your field
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}'
Once your mapping is updated (make sure to replace my_index
and my_type
with whatever index and mapping type name you have), you need to re-index your data and then you'll be able to query the author.raw
field in Kibana like this:
author.raw:/Jason P.*/
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With