I'm using Elasticsearch with elastic-apm==6.19.0 configured for Django. After logging an error message like
logger.exception(
custom_logging_message,
exc_info=True,
extra={
'status_code': status_code
},
)
I can indeed observe the error containing custom_logging_message in Kibana. In Elasticsearch, I can even use Query DSL to view the document which was created by the above logging event. It also holds the data which was passed to the logger using the extra keyword, as follows:
"error": {
...,
"custom": {
...,
"status_code": 500,
}
}
So far so great, but I want to write a query which is based on one of the extra fields. Like:
GET _search
{
"query": {
"range": {
"error.custom.status_code": {
"gte": 500
}
}
}
}
But the result is empty. I tried to figure out whether the respective field is indexed, using the following query: GET _my_error_index/_mapping?pretty. The result did indeed not hold the respective field under "mappings". Is this the reason why I could not use it in the search query? And if so, how to I get it indexed? Is it a setting in the elastic-apm package?
I am very new to this topic and appreciate any help. Thank you.