Hi Experts,

In my log I have a field "Customer". It has all the values in capital 
latter like "VIKAS". Now when I fire query in Kibana like Customer:"vikas" 
or Customer:"VIK*" I got nothing . It works only when I do exact search 
like Customer:"VIKAS".

I have following question

1) How I can search value with wildcard, something like name start with vi 
OR VI ?

My Template is like 

{
 "template_vg":{
    "template" : "vg*",
    "settings" : {
        "number_of_shards" : 5,
        "index.cache.field.type" : "soft",
        "index.refresh_interval" : "5s",
        "index.store.compress.stored" : true,
        "index.query.default_field" : "message",
        "index.routing.allocation.total_shards_per_node" : 5,
"index":{
                    "analysis":{
                        "analyzer":{
                          "analyzer_keyword":{
 "type": "custom",
                                 "tokenizer":"keyword",
                                  "filter":"lowercase"
              }
           }
        }
     }
    },
    "mappings" : {
        "_default_" : {
            "_all" : {"enabled" : false},
"properties" : {
"Order_ID": {"type": "string","index" :"not_analyzed","doc_values" : true},
"Customer": {"type": "string","index" : "not_analyzed","doc_values" : true 
,"analyzer":"analyzer_keyword"},
"Ordered_On": {"type": "string","index" : "not_analyzed","doc_values" : 
true },
"Required_By": {"type": "string","index" : "not_analyzed","doc_values" : 
true },
"Freight": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Shipped_On": {"type": "string","index" : "not_analyzed","doc_values" : 
true },
"Country": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Post_Code": {"type": "string","index" : "not_analyzed","doc_values" : true 
}
 }
}
}
}
}


I read almost everything and got an idea that I need to use analyzer with 
Lowercase filter which will convert my values to lowercase then I can apply 
wildcard.But with the above analyzer for Customer I still got nothing . Can 
someone help me to understand what I am doing wrong . 

-- 
Please update your bookmarks! We have moved to https://discuss.elastic.co/
--- 
You received this message because you are subscribed to the Google Groups 
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to elasticsearch+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/elasticsearch/eb6bda79-428d-4fdc-b478-65f07905fe89%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to