Elasticsearch not finding match for document that contains query - elasticsearch

Question

I am trying to search an index for documents that have exception field containing "semaphore" AND "RabbitMQ.Client.Impl".
Example exception:
System.ObjectDisposedException: The semaphore has been disposed.
at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)
at RabbitMQ.Client.Impl.AsyncConsumerWorkService.WorkPool.HandleConcurrent(Work work, IModel model, SemaphoreSlim limiter)
When I search for "semaphore" - document is returned - great!
POST /logs-2023-01/_search?pretty=true
{
"query": {
"bool": {
"must": [
{
"match": {
"exception": "semaphore"
}
},
{
"range": {
"logDate": {
"gte": "now-43200m"
}
}
}
]
}
},
"size": 1000
}
Query above returns:
{
"took": 5,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 7.5582323,
"hits": [
{
"_index": "logs-2023-01",
"_type": "record",
"_id": "q21yk4UBAdlSjmEEw5gy",
"_score": 7.5582323,
"_source": {
"applicationName": "k8s-application",
"logDate": "2023-01-08T22:13:59.873",
"logLevel": "Error",
"loggerName": "TaskScheduler.UnobservedTaskException.Logger",
"machineName": "k8s-pod-6755d4997c-rztgl",
"threadId": "2",
"message": "An unobserved task exception occurred. The semaphore has been disposed.",
"exception": """
System.ObjectDisposedException: The semaphore has been disposed.
at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)
at RabbitMQ.Client.Impl.AsyncConsumerWorkService.WorkPool.HandleConcurrent(Work work, IModel model, SemaphoreSlim limiter)
""",
"sortDate": "2023-01-08T22:13:59.000027026"
}
}
]
}
}
However when I do same search for query "RabbitMQ.Client.Impl" (which is 100% contained in the exception) - I get nothing - why?
POST /logs-2023-01/_search?pretty=true
{
"query": {
"bool": {
"must": [
{
"match": {
"exception": "RabbitMQ.Client.Impl"
}
},
{
"range": {
"logDate": {
"gte": "now-43200m"
}
}
}
]
}
},
"size": 1000
}
Query above returns:
{
"took": 8,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 0,
"max_score": null,
"hits": []
}
}

Answer 1

Tldr;
match queries will look for exact tokens.
Solution
Tokens are generated at ingestion time by the analyser.
The default analyser split token on whitespace.
Which means rabbitmq.client.impl.asyncconsumerworkservice.workpool.handleconcurrent is going to be a token.
Which is not going to match RabbitMQ.Client.Impl
But you can use match_phrase_prefix
with the following query:
GET 75236255/_search
{
"query": {
"match_phrase_prefix": {
"exception": "RabbitMQ.Client.Impl"
}
}
}