-
Notifications
You must be signed in to change notification settings - Fork 71
Description
Currently in the admin analytics, you have to enter your queries for most fields only using lower-cased text. Depending on the input, this can be rather non-obvious and unintuitive.
As an example, I was recently performing a query looking for Internet Explorer traffic. I picked the "Request: User Agent" field, the "contains" option, and then entered "MSIE". I hit submit and was initially perplexed why the system was reporting 0 results. It wasn't until I entered "msie" that I began getting results. To make matters more confusing, the user agent information being displayed in the table of results contains upper-cased entires like "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)".
This stems from how we index data into ElasticSearch, since we lowercase most of the strings for indexing purposes to allow for easier case-insenstive searching. However, we're currently missing the other half of this puzzle to actually allow for case-insensitive searching, since we need to automatically lowercase the queries. I think this should be fairly easy to implement with the new analytics query UI. We just need to be careful not to lowercase the searches for fields marked as not_analyzed, since those fields are purposefully kept case-sensitive. See the elasticsearch template for which fields are not analyzed. All other string columns default to the keyword_lowercase analyzer and should be lowercased.