Didn't you read my previous answer? This example has nothing in common with your data! That said, you need to apply the mapping before indexing any document!
We can't help you without a full curl recreation which actually reproduce your issue. I think you are doing something wrong here but it's difficult to say without any clue. -- David Pilato | Technical Advocate | Elasticsearch.com @dadoonet | @elasticsearchfr Le 12 mars 2014 à 11:08:24, Subhadip Bagui (i.ba...@gmail.com) a écrit: Hi Binh, The query you given is working. Thanks for your help. But if I change the query and search for string "requestproxyauthentication" instead, It's not working. Below is the mapping for message field. I'm trying to understand how elasticsearch analyze the field data. Pls comment. "message":{ "type":"string", "norms":{ "enabled":false }, "fields":{ "raw":{ "type":"string", "index":"not_analyzed", "ignore_above":256 } } } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/fb30d7b5-11ab-4ee7-a3cb-647663b11623%40googlegroups.com. For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/etPan.53203334.2ae8944a.bfa%40MacBook-Air-de-David.local. For more options, visit https://groups.google.com/d/optout.