2

I'm unable to perform a search using a filtered term query on a numeric value (ES 2.3), despite according the doc (term Query with numbers) it should work:

GET log_*/_search

{
  "query": {
    "bool": {
      "filter": [
        {"term": {"message.type": "processing"}}
      ]
    }
  }

Result:

{
  "took": 7,
  "timed_out": false,
  "hits": {
    "total": 9454958,
    "max_score": 0,
    "hits": [
      {
        "_index": "log_2018-07-20",
        "_type": "INFO",
        "_id": "AWS3u23h9aQ1Q463t1cE",
        "_score": 0,
        "_source": {
          "message": {
            "trackid": 1767513415295398400,
            "type": "processing",
            // other data ...
          },
          "ts": "2018-07-20T12:47:46.867271"
        }
      },

     // other results ... 

    ]
  }
}

If I query for the same message.trackid returned in the previous query...

GET log_*/_search

{
  "query": {
    "bool": {
      "filter": [
        {"term": {"message.trackid": 1767513415295398400}}
      ]
    }
  }
}

...I get nothing:

{
  "took": 2,
  "timed_out": false,
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

Mapping of the field:

{
  "log_2018-07-20": {
    "mappings": {
      "ERROR": {
        "properties": {
          "message": {
            "properties": {
              "trackid": {
                "type": "long"
              },
              // other fields...
            }
          }
        }
      },
      "INFO": {
        "properties": {
          "message": {
            "properties": {
              "trackid": {
                "type": "long"
              },
              // other fields...
            }
          }
        }
      },
      // you got the idea
    }
  }
}

Any thought?

Cavaz
  • 2,996
  • 24
  • 38
  • 1
    this answer might help: https://stackoverflow.com/questions/38952262/elasticsearch-max-length-of-mapping-type-long/38952540#38952540 – Val Jul 24 '18 at 15:23
  • dammit you're right, queries below 2^54 works. Maybe related, now that I notice the values are oddly round too (1767513415295398400, 1394536019028343000, 1957941955163219200, ...). – Cavaz Jul 24 '18 at 15:40
  • 1
    One way to go around this is simply to index the field as a `keyword` instead of `long` – Val Jul 24 '18 at 15:44
  • yeah. In this case I can cap the max value of trackid, it will quicker than changing the mapping + migrating the index. Thx man! – Cavaz Jul 24 '18 at 15:48
  • 2
    Note that you cannot change the type from long to keyword without reindexing. Either you change the mapping of the trackid field and reindex your data, or you create a new additional field of type `keyword` and hit the update by query API in order to index that field. – Val Jul 24 '18 at 15:53

0 Answers0