通过通配符搜索elasticsearch字符串字段

Question

My elasticsearch index has a "message" field of type string. I'm trying to search for records that contain a partial match on the message field. For example, if the record contains "Hello World", then searching for "hello", "Hello", "ow", etc... would result in a match.

Here is a sample record in the index:

{
        "_index": "applicationlogs",
        "_type": "upstream",
        "_id": "d7Hj12EBs1AV7_j_56mg",
        "_score": null,
        "_source": {
          "@timestamp": "2018-02-27T09:33:16.7817021-06:00",
          "level": "Information",
          "messageTemplate": "Elasticsearch log level configured to Information",
          "message": "Elasticsearch log level configured to Information",
          "fields": {
            "SourceContext": "Rpr.Agg.Program",
            "ApplicationVersion": "1.0.0.0",
            "ServiceName": "BDF_SERVICE_SWBR2DEV-JTC01",
            "MachineName": "SWBR2DEV-JTC01",
            "Application": 8
          }
        },
        "sort": [
          1519745596781
        ]
      },

Here is the relevant part of the class that mirrors the index:

public class ElasticsearchLogEntry
    {
        [Text(Name = "@timestamp")]
        public DateTime TimeStamp { get; set; }
        public string Level { get; set; }
        [Text]
        public string Message { get; set; }
    }

And here is the relevant part of the query that I have so far, which only matches on the full string:

public async Task<IEnumerable<ElasticsearchLogEntry>> GetAllLogEntries(string search, int skip, int take)
        {
            var filters = new List<Func<QueryContainerDescriptor<ElasticsearchLogEntry>, QueryContainer>>();
            if (!String.IsNullOrEmpty(search))
                filters.Add(fq => fq.Match(m => m.Field("message").Query(search)));

            var response = await client.SearchAsync<ElasticsearchLogEntry>(i => i
                .Index("applicationlogs")
                .Type("upstream")
                .Query(q => q.Bool(bq => bq.Filter(filters)))
                .Sort(s => s.Descending(so => so.TimeStamp))
                .Skip(skip)
                .Take(take));
            return response.Documents.AsEnumerable();
        }

Any ideas how I can get it working correctly?

Answer 1

I had assumed that I was simply getting 0 results back, but it turns out I was actually getting an error:

{ServerError: 400Type: parsing_exception Reason: "[match] query does not support [type]"}

I thought this was because I'm setting a Type in my query, however even after removing it I still get the error. I think this is because I'm connecting to a ES 6 instance on Amazon while using the NEST / ElasticSearch.Net 5.x nuget packages. See this .

Unfortunately, the whole reason why I'm using the 5.x nuget packages is because 6 didn't work for me or the other developers on my team. The api calls always give this error :

UnexpectedElasticsearchClientException: Method not found: 'Elasticsearch.Net.PostData`1 Elasticsearch.Net.RequestData.get_PostData()'.

So this leaves me in a bit of a bind...

EDIT: They released an update to the ES AWS nuget package that supports 6.x, so I was able to upgrade everything and get past these errors.