From e0a24854aca12d66d8fcb5b2aea6dc1be72c6b90 Mon Sep 17 00:00:00 2001 From: Matt Riedemann Date: Tue, 7 Jan 2014 09:27:53 -0800 Subject: [PATCH] Add some documentation on wildcard limitations in queries The logstash UI will return hits on wildcarded queries but the ElasticSearch configuration by default disables wildcard analysis so queries in elastic-recheck with wildcards currently do not work, so let's make sure this is documented in the readme. Related-Bug: #1266833 Change-Id: If6b9d99d7ba83272fc8b735ab9e67fe1ee993811 --- README.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.rst b/README.rst index 92eb0f9a..9a57584b 100644 --- a/README.rst +++ b/README.rst @@ -59,6 +59,13 @@ further down the stack that can cause many tempest tests to fail. find the log message from step 1. To see the possible fields to search on click on an entry. Lucene query syntax is available at http://lucene.apache.org/core/4_0_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html#package_description + + Note that wildcard analysis is disabled by default in ElasticSearch so + while a query in logstash might work with wildcards, it will not work in + elastic-recheck. See the ElasticSearch documentation for more information + on wildcard analysis: + http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_wildcards + #. Add a comment to the bug with the query you identified and a link to the logstash url for that query search. #. Add the query to ``elastic-recheck/queries/BUGNUMBER.yaml`` and push