*Double quotes are required for phrase searching, single quotes do not work
**Not analyzed fields are case sensitive
***Allowing a wildcard at the beginning of a word (eg "*ing") is particularly heavy, because all terms in the index need to be examined, just in case they match
Analyzed vs Not Analyzed (.raw)
Above is how Elasticsearch stores analyzed vs not analyzed strings for searching.
Not analyzed fields need to be searched as one phrase.
Analyzed fields can be searched using one or more of its sections.
Download the Kibana Search Tips Cheat Sheet
Share This Cheat Sheet!
Your Download Will Begin Automatically in 5 Seconds.