I am getting this query when i try to run below query from Postman
{ "error": { "root_cause": [ { "type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set
fielddata=true on [ID] in order to load fielddata in memory by
uninverting the inverted index. Note that this can however use
significant memory. Alternatively use a keyword field instead." }
Here is the request
{
"size": 11,
"query": {
"bool": {
"filter": [
{
"bool": {
"must": [
{
"term": {
"search.doc.TypeId": {
"value": 1,
"boost": 1.0
}
}
}
],
"adjust_negative": true,
"boost": 1.0
}
}
],
"adjust_negative": true,
"boost": 1.0
}
},
"sort": [
{
"ID": {
"order": "desc"
}
}
]
}
Based on the error it seems that the objectID field is of text type. By default, field data is disabled on text fields.
So, according to the error, first, you need to modify your index mapping, so that the text field have field data enabled. Modify your index mapping, as shown below
PUT <index-name>/_mapping
{
"properties": {
"objectID": {
"type": "text",
"fielddata": true
}
}
}
Now use the same search query as given in the question, to get the desired results.
Related
I have a scenario where the values in the "term" can be either bool or text. In my mapping templates how can i have it as a multi type field ?
Mapping template:
"terms": {
"type": "nested",
"properties": {
"values": {
"type": "keyword",
index": "true"
}
}
}
I am using JSON config like below to form elastic query. As I mentioned sometimes the value is text and sometime bool. i want it to work in both the case.
Bool:
"terms": {
"values": [
true
]
}
Text:
"terms": {
"values": [
"Variable pay"
]
}
Currently in case of bool also I am providing value as text.
I am using ES 7.17
I have an index with a few hundred thousand documents. Some of them have a rank_features field called my_field. I want to retrieve documents without that field.
I tried:
"query": {
"bool": {
"must_not": [
{"exists": {"field":"my_field"}}]
...
But I get the following error:
"error": {
"root_cause": [
{
"type": "query_shard_exception",
"reason": "failed to create query: [rank_features] fields do not support [exists] queries",
...
The index mapping is defined as follows:
"mappings": {
"dynamic": "strict",
"_routing": {
"required": true
},
"properties": {
"my_field": {
"properties": {
"my_subfield": {
"type": "rank_features"
}
}
...
"settings": {
"index": {
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_content"
}
}
},
"mapping": {
"total_fields": {
"limit": "2000"
}
},
"refresh_interval": "1s",
"number_of_shards": "10",
"blocks": {
"write": "false"
},
Note that despite the mapping being strict, this field was added recently and older documents don't have it.
Tldr;
You are doing a exist query against a field that only support rank_feature queries
As per the documentation of the rank_features field.
rank_features fields do not support sorting or aggregating and may only be queried using rank_feature queries.
I have an elasticsearch index with following mapping, some documents contain objects of status {id:1, status:"failed"} and some are null, cant seem to find a way where i can search for documents having "status.name" as ["failed", "null", "passed"] (docs where either status is failed, passed or not set/null). e.g doing a term query like below gives empty resultset
{
"name":{
"type":"keyword"
}
"status": {
"properties": {
"id": {
"type": "integer"
},
"status": {
"type": "keyword"
}
}
}
}
query tried:
{
"terms": {
"status.name": [ "failed", "null" ]
}
Also tried setting the mapping of status.name as "null_value": "null"
Use a bool query with only should clauses, making it a requirement that at least one of your queries must match. You can query for documents not having a field or having a null-value in that field by putting an exists-query into the must_not-clause of a bool-query (see Elasticsearch Reference: Exists-query).
GET myindex/_search
{
"query": {
"bool": {
"should": [
{"term": {"status.name": {"value": "failed"}}},
{"term": {"status.name": {"value": "passed"}}},
{"bool": {"must_not": {"exists": {"field": "status.name"}}}}
]
}
}
}
I have a field which is defined in mappings as:
"route": {
"type": "ip_range"
}
It works well, and I see the results when I query the ES:
"_source": {
"ip": "65.151.40.164",
"route": "65.151.40.0/22",
...
}
Now I want to do some aggregations of this field, and pretty much everything I try ends up being this error:
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Fielddata is not supported on field [route] of type [ip_range]",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Fielddata is not supported on field [route] of type [ip_range]"
}
}
I hope that it doesn't mean that ES doesn't support aggregations for ip_range? Or if it does, how can it be done?
UPDATE
As I said, so far any aggregations that work on other types (including ip type) don't work on ip_range.
Some examples:
{
"size": 0,
"aggs": {
"routes": {
"range": {
"field": "route",
"ranges": [
{"to": "10.0.0.0/32"}
]
}
}
}
}
{
"size": 0,
"aggs": {
"routes": {
"terms": {
"field": "route",
"size": 50
}
}
}
}
If anyone can point me to an aggregation that does work on ip_range that would be helpful!
There's a specific ip_range aggregation for the ip_range field type, i.e. do not use the range aggregation (only for numeric types) and terms (only for numeric and keyword types):
GET /ip_addresses/_search
{
"size": 10,
"aggs" : {
"routes" : {
"ip_range" : {
"field" : "route",
"ranges" : [
{"to": "10.0.0.0/32"}
]
}
}
}
}
I am having hard times applying a background filter to a nested significant terms aggregation , the bg_count is always 0.
I'm indexing article views that have ids and timestamps, and have multiple applications on a single index. I want the foreground and background set to relate to the same application, so I'm trying to apply a term filter on the app_id field both in the boo query and in the background filter. article_views is a nested object since I want to be also able to query on views with a range filter on timestamp, but I haven't got to that yet.
Mapping:
{
"article_views": {
"type": "nested",
"properties": {
"id": {
"type": "string",
"index": "not_analyzed"
},
"timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
"app_id": {
"type": "string",
"index": "not_analyzed"
}
}
Query:
{
"aggregations": {
"articles": {
"nested": {
"path": "article_views"
},
"aggs": {
"articles": {
"significant_terms": {
"field": "article_views.id",
"size": 5,
"background_filter": {
"term": {
"app_id": "17"
}
}
}
}
}
}
},
"query": {
"bool": {
"must": [
{
"term": {
"app_id": "17"
}
},
{
"nested": {
"path": "article_views",
"query": {
"terms": {
"article_views.id": [
"1",
"2"
]
}
}
}
}
]
}
}
}
As I said, in my result, the bg_count is always 0, which had me worried. If the significant terms is on other fields which are not nested the background_filter works fine.
Elasticsearch version is 2.2.
Thanks
You seem to be hitting the following issue where in your background filter you'd need to "go back" to the parent context in order to define your background filter based on a field of the parent document.
You'd need a reverse_nested query at that point, but that doesn't exist.
One way to circumvent this is to add the app_id field to your nested documents so that you can simply use it in the background filter context.