Kibana query doesn't return all relevant logs - elasticsearch

I tried to present msg1/msg2 that refer to id13/id22, as shown below:
(message:"msg1" or message:"msg2'") and (Id:13 or Id:22)
The first condition works well, but the second part doesn't - only results referring to id13 return, when there for sure are relevant logs that apply to id22 as well.
Any ideas?
Hello,
I tried to present msg1/msg2 that refer to id13/id22, as shown below:
(message:"msg1" or message:"msg2'") and (Id:13 or Id:22)
The first condition works well, but the second part doesn't - only results referring to id13 return, when there for sure are relevant logs that apply to id22 as well.
Any ideas?

Related

as.POSIXct sometimes could not convert

Please see the following example: some values could not be translated by as.POSIXct
as.POSIXct("2019-03-21T07:51:41.521Z")
as.POSIXct("2019-03-22T05:35:47.824Z")
The first is working, however, the second one did not work what is the difference!

OBIEE Passing Parameter to Analysis With URL

I have this Analysis that I wish to invoke from URL (which I can).
This analysis in particular is mounted on a dashboard and 6 of the 17 columns can be filtered from a prompt mounted on the same dashboard.
I only need the analysis and still be able to filter the results. I read about parameters that can be given to the URL, but I can't seem to make the filters work. I am using the &P0=n parameter and the consequent &P1=xx parameter.
Without the &P I am able to see the table, when I add parameters I get this error UH6MBRBC:E6MUPJPH.
Thanks for your time, have a nice day.
Got it to work by myself afterall (always best).
Basically instead of &p0 and such I used &coln and &valn (where n is the column number):
&coln - is the name of the field
&valn - is the value for which you filter
More information and better explanation can be found here.

GSA includes the keyword start in the search results when I am searching for restart

I am facing a strange issue with a specific search.
I would expect the below two queries to return the same result set since space between keywords interpreted as AND anyway:
1) inurl:taskcracker Angela restart crash
2) inurl:taskcracker Angela AND restart crash
First one returns 42 results where the highlighted keywords on the search result page includes 'start' in addition to 'restart'. Whereas the second query returns only 2 results with 'restart' only (no 'start') which what I was expecting from the first search as well.
Please note that it does not matter whether I put an AND in front of other keywords on the 2nd query. It only makes a difference when I put or don't put an AND in front of 'restart'
I initially thought that maybe restart is in the synonyms list under Search > Query Settings > Synonym Data > English in the GSA admin panel but it is not there.
So the issue is when I don't put an explicit AND in front of 'restart' GSA expands it to include 'start' as well.
Any ideas whether this comes from a configuration somewhere on the admin panel or likely to be a bug?
This is probably because query expansion doesn't work when you put AND before "restart".
Can you try adding &entqr=0 to the URL being sent to the GSA? It controls the the query expansion policy. You can also try &entqrm=0 too if first one doesn't work.

Odd behavior with AND condition in elasticsearch

When I run the query (tags:("a")) in elasticsearch, I get 0 results. My query URL looks like:
http://127.0.0.1:9200/haystack/_search?q=(tags%3A(%22a%22))
That is to be expected, since no objects have a tag set to "a".
Now when I change the condition, and add an AND, (org:("1") AND tags:("a")), I get 3 results back! The query URL looks like:
http://127.0.0.1:9200/haystack/_search?q=(org%3A(%221%22)%20AND%20tags%3A(%22a%22))
Getting more results back does not make any sense to me. I would expect that kind of behavior with the OR operator, but AND? What is going on?
Edit: This is caused by the snowball analyzer. See here

SolrNet query assistance and some debugging options

How would I use SolrNet to execute a GREATER THAN/LESS THAN query?
Example:
My documents have a field called "minimumDays" and I only want to return docs where that field is LESS THAN OR EQUAL TO the number I pass into the query.
I currently have this, but am not sure it's correct.
int requestedDays = 3;
var minimumNightsQuery = new SolrQueryByRange<int>("minimumDays", 0, requestedDays, true);
Am I on the right track?
The second part here is if there is some way to better understand the query that is being passed into Solr from SolrNet? Debugging value or something where I can inspect the "q" variable for instance.
Thanks again for your help
You can use SolrQueryByRange for the first part of your question. Your code does look good. debugging your query and results might help. I have found that SolrNet does some odd things. - http://code.google.com/p/solrnet/wiki/Facets#Arbitrary_facet_queries
For the second part, You can intercept the ISolrConnection and put in your own in between. For a good start check this out: http://code.google.com/p/solrnet/source/browse/trunk/SampleSolrApp/LoggingConnection.cs?r=513
I have one that logs the query and the results, and if a config setting is on it appends the debug param and logs that result also. Its great info to have.... and one of the only ways to get it.

Resources