Search code examples
elasticsearchlucenelogstashkibana-4

Kibana 4 - Why does my simple query return correct results when using .raw but not without?

I'm trying out Elasticsearch/Kibana 4 and while my simple query:

program.raw:"MYAPPLICATION" AND entityId.raw:"12345-67N"

will return the results I want - i.e. result posts having the program and entityId field and containing the queried terms straight off, as I want.

However, I guess the right way to query this would be:

program:"MYAPPLICATION" AND entityId:"12345-67N"

but that gives my correct results only regarding the program query, and then a lot of hits on terms containing N or n. The entityId-part seems to only query on N?. I'm confused, please explain this. I've read up on the Lucene query syntax and can't find anything explaining this.

Solution

  • The .raw fields are setup by logstash as "not_analyzed" fields in elasticsearch. As such, they are not split into tokens and can be used intact.

    To elasticsearch, entityId really looks like ['12345', '67n'], which is why your query doesn't match.

    Note that, in your example, program:myapplication should work (since there are no special characters). Lowercase is automatic, IIRC.