Add some documentation on wildcard limitations in queries

The logstash UI will return hits on wildcarded queries but the
ElasticSearch configuration by default disables wildcard analysis so
queries in elastic-recheck with wildcards currently do not work, so
let's make sure this is documented in the readme.

Related-Bug: #1266833

Change-Id: If6b9d99d7ba83272fc8b735ab9e67fe1ee993811
This commit is contained in:
Matt Riedemann 2014-01-07 09:27:53 -08:00
parent 7e616f2a85
commit e0a24854ac

View File

@ -59,6 +59,13 @@ further down the stack that can cause many tempest tests to fail.
find the log message from step 1. To see the possible fields to find the log message from step 1. To see the possible fields to
search on click on an entry. Lucene query syntax is available at search on click on an entry. Lucene query syntax is available at
http://lucene.apache.org/core/4_0_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html#package_description http://lucene.apache.org/core/4_0_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html#package_description
Note that wildcard analysis is disabled by default in ElasticSearch so
while a query in logstash might work with wildcards, it will not work in
elastic-recheck. See the ElasticSearch documentation for more information
on wildcard analysis:
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_wildcards
#. Add a comment to the bug with the query you identified and a link to #. Add a comment to the bug with the query you identified and a link to
the logstash url for that query search. the logstash url for that query search.
#. Add the query to ``elastic-recheck/queries/BUGNUMBER.yaml`` and push #. Add the query to ``elastic-recheck/queries/BUGNUMBER.yaml`` and push