Elasticsearch7 query match_phrase with IP or Number does not work

Question

I am trying to parse an error message in ES7. The message contains IPs and Numbers. I tried with regex and with simple search inserting the first part of the IP. Both are not working.

This my simple match_phrase query. The query works fine until "IP", but, as soon as I extend the query to the first number in IP I get 0 matches:

"match_phrase": {
            "mylog.messages": {"query": "The device with IP 127."}}

My regex query gives me a 400 error:

"regexp": {"mylog.messages": {"value":"The device with IP /[0-9]{1-3}\.[0-9]{1-3}\.[0-9]{1-3}\.[0-9]{1-3}/"}}

Any advice on how to match IPs in error messages are welcome. Thanks

jaspreet chahal · Accepted Answer · 2022-10-28 10:54:00Z

0

Ip address will not work with match pharse. You will need custom analyzer to make it work with match pharse

I have corrected your regex. You can get more info on supported regex syntax from here

{
  "query": {
    "regexp": {
      "messages.keyword": {
        "value": "The device with IP [0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}"
      }
    }
  }
}

answered Oct 28, 2022 at 10:54

jaspreet chahal

9,1472 gold badges14 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Furin Over a year ago

Thanks for correcting the regex...but I am still getting 0 match :(

jaspreet chahal Over a year ago

@Furin you are searching on keyword field?

Furin Over a year ago

I tried both with and without, I get the same results: 0 :(

jaspreet chahal Over a year ago

@Furin can you add sample document

Furin Over a year ago

Unfortunately I can't

|

Collectives™ on Stack Overflow

Elasticsearch7 query match_phrase with IP or Number does not work

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related