Do operators in query are case sensitive ?

[aadimurthy]

Hi,

I have configured elastalert as a service and it has a query that has 'and' operator as below.

complete config insdie YAML file:
(This is to create an alert when number of docs containing company value 11111 and cloudId values as 22222 are less than 1000 )

name: "open_alert"
type: flatline
index: "metricbeat-*"
threshold: 1000
timeframe:
  seconds: 10
filter:
- query:
    query_string:
      query: "companyId: 11111 and cloudId: 22222"
use_count_query: false
use_terms_query: true
terms_size: 500
query_key: "cloudId"
doc_type: _doc
alert:
  - post
http_post_url: "http://localhost:8085/api"
http_post_static_payload: {}
alert_text: "Data not received for asset: {0}"
alert_text_type: alert_text_only
alert_text_args:
- key

The problem with the above config is. it only works as expected if using a query with operator 'AND' (uppercase)

query: "companyId: 11111 AND cloudId: 22222"

if I use operator in lowercase i.e 'and' as below it does not work as expected and ignore the part in the query from the point where the operator starts.

i.e
query: "companyId: 11111 and cloudId: 22222". ---> is equivalent to query: "companyId: 11111"

My question is, does the operator in lower case is not a valid one? if so why the whole query should fail altogether?

[jertel]

Yes, operators must be upper case. This is an Elastic topic - for more information please consult their documentation or support forums.

[aadimurthy]

Yes, you are correct! @jertel . I think it is one of the problems of Lucene query syntax. They are nicely summarized here