Thanks for responding.
It is *surely* not_analyzed - hence my frustration. Here is the mapping
{
"my_index": {
"mappings": {
"my_type": {
"properties": {
"@timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"CounterName": {
"type": "string",
"index": "not_analyzed"
},
"CounterValue": {
"type": "double"
},
"DeploymentId": {
"type": "string",
"index": "not_analyzed"
},
"EventTickCount": {
"type": "long"
},
"PartitionKey": {
"type": "string",
"index": "not_analyzed"
},
"Role": {
"type": "string",
"index": "not_analyzed"
},
"RoleInstance": {
"type": "string",
"index": "not_analyzed"
},
"RowKey": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}
On Monday, 2 February 2015 13:20:49 UTC, Itamar Syn-Hershko wrote:
>
> It looks like your field is analyzed and you are trying to query it
> assuming its not_analyzed (e.g. one string). Hard to say without seeing
> your index mapping.
>
> --
>
> Itamar Syn-Hershko
> http://code972.com | @synhershko <https://twitter.com/synhershko>
> Freelance Developer & Consultant
> Lucene.NET committer and PMC member
>
> On Mon, Feb 2, 2015 at 3:08 PM, Ali Kheyrollahi <alio...@gmail.com
> <javascript:>> wrote:
>
>> Any help please??
>>
>> On Saturday, 31 January 2015 09:56:38 UTC, Ali Kheyrollahi wrote:
>>>
>>> Hi,
>>>
>>> I really haven't found a consistent way to use query window in Discover
>>> or Visualize tabs. My results become hit and miss and inconsistent.
>>>
>>> So I am searching for types of "my_type" and I have a field called
>>> CounterName and I am looking for \Windows Azure
>>> Caching:Client(w3wp_2392)\Total Local Cache Hits
>>>
>>> Funny thing is searching for verbatim value does not work:
>>> CounterName"\Windows Azure Caching:Client(w3wp_2392)\Total Local Cache
>>> Hits"
>>> And I have to escape only backslashes (well I am using double quotes so
>>> it is literal, no?) and not brackets or colon:
>>> CounterName"\\Windows Azure Caching:Client(w3wp_2392)\\Total Local
>>> Cache Hits"
>>>
>>> Now, the 2392 number here is variable (pid on the box) so I am trying to
>>> look for \Windows Azure Caching:Client(w3wp_*)\Total Local Cache Hits and
>>> I have tried all these to no avail:
>>>
>>> CounterName:"\\Windows Azure Caching:Client(w3wp_*)\\Total Local Cache
>>> Hits"
>>> CounterName:"\\Windows Azure Caching:Client(w3wp_\*)\\Total Local Cache
>>> Hits"
>>> CounterName:"\Windows Azure Caching:Client(w3wp_"*"\Total Local Cache
>>> Hits" (nothing comes back)
>>>
>>> And also tried regex:
>>>
>>> CounterName:/\Windows Azure Caching:Client(w3wp_*)\\Total Local Cache
>>> Hits/
>>> CounterName:/\Windows Azure Caching:Client(w3wp_.*)\\Total Local Cache
>>> Hits/
>>> ...
>>>
>>> With many different combinations of replacing reserved chars with ?.
>>>
>>> What am I doing wrong?
>>>
>>> Thanks
>>>
>>>
>>>
>>> --
>> You received this message because you are subscribed to the Google Groups
>> "elasticsearch" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to elasticsearc...@googlegroups.com <javascript:>.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com
>>
>> <https://groups.google.com/d/msgid/elasticsearch/54e8264f-00ee-4327-b4fc-ae074152669e%40googlegroups.com?utm_medium=email&utm_source=footer>
>> .
>> For more options, visit https://groups.google.com/d/optout.
>>
>
>
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to elasticsearch+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/a5aa9d83-a0cc-459d-87fe-d5da8142a4fb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
