Hi folks,
I have an issue with the search query on a long data type field.
My Apache logs are fed to graylog with a GROK pattern like :
%{HOSTNAME} %{NOTSPACE:apache-process} %{COMBINEDAPACHELOG} %{NOTSPACE:cookie} %{INT:tookms;int}
tookms is in millisec. I made sure ES index uses a numeric type :
curl -X GET http://127.0.0.1:9200/apache_4/_mapping?pretty
returns this field amongst others :
"tookms" : {
"type" : "long"
},
So, I would expect to be able to search for requests like :
source:aspxaswebp* and tookms:<1000
EDIT :
Embaracing how I forgot to use capital AND…
Please delete this post.
I appreciate a lot the help you offered Macko003. Thanks.