0

similar to question I want to create a query on a sub field (which is not of type nested)

if data is in format

"fs": {
    "used": 1000,
    "mount_point": "/"
 }

as mentioned in answer by aaronfay I tried querying with

search.query('match', **{"fs.used": 0})

and it works as expected.

But for field named mount_point, the query returns empty response.

search.query('match', **{"fs.mount_point": "/"})

even if i have data which has mount_point = '/'. why?

Community
  • 1
  • 1
Siddhesh Suthar
  • 425
  • 7
  • 9

1 Answers1

1

What is your mappings for the mount_point field? You need that field to be of type keyword which means without any analyzer. By default it would be text which means it would be split into words and / is not a word so it would get dropped.

Honza Král
  • 2,982
  • 14
  • 11
  • thanks for the response. Its the default mapping of topbeat index created by logstash. `mount_point` field's mapping is of type `string` ` "fs" : { ... "mount_point" : { "type" : "string" }, "used" : { "type" : "long" }, ... } }, ` so should i change the mapping of this field to `keyword` – Siddhesh Suthar Feb 24 '17 at 09:32
  • solved temporarily by comparing with another field (which doesn't have only '/' in value. ` .query('match', **{"fs.device_name": "/dev/sda4"} ` – Siddhesh Suthar Feb 24 '17 at 10:26