term query matches a single term as it is : the value is not analyzed. So, it doesn’t have to be lowercased depending on what you have indexed. If you provided Bennett at index time and the value is not analyzed, the following query won’t return anything : { “query”: { “term” : { “user” … Read more
Yep, Use a better option source filter. If you’re searching with JSON it’ll look something like this: { “_source”: [“user”, “message”, …], “query”: …, “size”: … } In ES 2.4 and earlier, you could also use the fields option to the search API: { “fields”: [“user”, “message”, …], “query”: …, “size”: … } This is … Read more
In elasticsearch, it’s not possible to paginate an aggregation. The query will not give accurate results if size is specified. So, the only way to do sorting and pagination is to give size 0 and return all the documents and then, get the required results by accumulating all the results in a list for further … Read more
You have various problems with what you pasted: 1) Incorrect mapping When creating the index, you specify: “mappings”: { “files”: { But your type is actually file, not files. If you checked the mapping, you would see that immediately: curl -XGET ‘http://127.0.0.1:9200/files/_mapping?pretty=1’ # { # “files” : { # “files” : { # “properties” : … Read more
You can achieve this with the Logstash aggregate filter only, however, you’d have to substantially re-implement what the elapsed filter already does, so that’d be a shame, right? Let’s then use a mix of the Logstash aggregate filter and the elapsed filter. The latter is used to measure the time of each stage and the … Read more
Edit /etc/elasticsearch/elasticsearch.yml and add the following line: network.host: 0.0.0.0 This will “unset” this parameter and will allow connections from other IPs.
You can use the terms aggregation. { “size”: 0, “aggs” : { “langs” : { “terms” : { “field” : “language”, “size” : 500 } } }} The size parameter within the aggregation specifies the maximum number of terms to include in the aggregation result. If you need all results, set this to a value … Read more
In your HEAD plugin, you need to use POST in order to send the query in the payload, otherwise the _search endpoint is hit without any constraints. In your browser, if you open the developer tools and look at the networking tab, you’ll see that nothing is sent in the payload when using GET. It’s … Read more
OR is spelled should AND is spelled must NOR is spelled should_not Example: You want to see all the items that are (round AND (red OR blue)): { “query”: { “bool”: { “must”: [ { “term”: {“shape”: “round”} }, { “bool”: { “should”: [ {“term”: {“color”: “red”}}, {“term”: {“color”: “blue”} ] } } ] } … Read more
That’s a great start! I would definitely flatten it all out (i.e. denormalize) and come up with product documents that look like the one below. That way you get rid of the N:M relationship between products and flags by simply creating a flags array for each product. It will thus be easier to query those … Read more