I have a match_phrase_prefix query, which works as expected. But when the users passes any special characters at the end of the keyword, ES ignores these characters, and still returns the result.
query{ match_phrase_prefix:{ content: { query: searchTerm } } }
I am using this query to search for prefix. If i pass a term like overflow####!! ES is returning me all the results with the word overflow in it. But instead i want to make an exact prefix match, where the special characters are not ignored. The search term could be of multiple words as well stack overflow search.
How could i make ES search of prefix_match without ignoring the special_chars.
You can use keyword analyzer when defining your query.
{
"query": {
"match_phrase_prefix": {
"content": {
"query": "overflow####!!",
"analyzer": "keyword"
}
}
}
}
Related
I have an Elasticsearch field values slim and extra slim, If I search for slim I'm getting extra slim included documents as a result. I want to match the exact word. I used fieldName.keyword while querying but It did'nt work if the field has multiple words.
The query I used is
{"query_string": {"query": "(fit:slim)" } }
How to match only specified value using query_string?
When looking for exact match against a field use term query on keyword field.
Query:
{
"query": {
"term": {
"fit.keyword": "slim"
}
}
}
UPDATE: Via query_string
For exact match using query_string wrap the string to be matched in quotes.
{
"query": {
"query_string": {
"query": "fit.keyword:\"extra slim\""
}
}
}
I have a match query searching for a type of doc:
{
"query": {
"bool": {
"should": {
"match": {
"ph1_enc": "EAAQnb1kMr/e2/ADqo"
}
}
}
}
}
"EAAQnb1kMr/e2/ADqo" is the string i'm trying to match, however in the search results I can see multiple records with substring "/e2/" are also returned.
Looks like "/e2/" is indexed separately, so that this could happen.I thought the match query is to do full-text match... Is it because I missed something when creating the template? Any idea?
Add-on instead of reindex, how to modify the query to match the exact value in the query?
Which analyzer do you set in the mapping to index your data?
If you are using the default one (standard analyzer), then according to the documentation, this uses the default tokenizer that seems to split also the text by slash ('/'). The documentation redirects here for more information about the tokenizer.
So, that will index the following words 'EAAQnb1kMr', 'e2', and 'ADqo'. Accordingly, your query value will also been analyzed the same way the field was indexed. That is why documents with 'e2' are also being returned.
If you don't need to tokenize the 'ph1_enc' field, you can just set its type in the mapping as 'keyword'.
"properties": {
"ph1_enc": {
"type": "keyword"
}
}
That will not analyze the field and it will match exactly while you query.
I hope that it helps.
I have a field named "tag" which is analyzed(default behavior) in elasticsearch. The "tag" field can have a single word or a comma separated string to store multiple tags. For eg. "Festive, Fast, Feast".
Now for example if a tag is "Festive", before indexing I am converting it to small case(to ignore case sensitivity) and indexing it as "festive".
Now if I search using a match query with all caps letters as mentioned below I get results fine(as expected).
{
"query": {
"match": {
"tag": "FESTIVE"
}
}
}
But if I do a wildcard query as mentioned below I don't get results :(
{
"query": {
"wildcard": {
"tag": {
"value": "F*"
}
}
}
}
If I change the value field in wildcard search to "f*" instead of "F*" then I get results.
Does anyone have any clue why is wildcard query behaving case sensitive?
Wildcard queries, fall under term level queries and hence not analyzed. From the Docs
Matches documents that have fields matching a wildcard expression (not
analyzed)
You will get expected results with query string query, it will lowercase the terms because by default as lowercase_expanded_terms is true. Try this
GET your_index/_search
{
"query": {
"query_string": {
"default_field": "tag",
"query": "F*"
}
}
}
Hope this helps!
I have a field in a document stored in Elastic Search, which I want to be analyzed as a full text field. In one case, it contains a value for the name field like this:
A&B Corp
I want to be able to search the documents for an auto-complete widget, using a query like this (suppose the user typed A&B into the autocomplete field). The intention is to match documents that contain the any terms with the typed prefix.
{ "query": {
"filtered": {
"query": {
"query_string": {
"query": "A&B*",
"fields": [
"firstName",
"lastName",
"name",
"key",
"email"
]
}
},
"filter": {
"terms": {
"environmentId": [
"foo"
]
}
}
}
}
}
```
My mapping for the name field looks like this:
"name": {
"type": "string"
},
But, I get no results. The query structure works for documents that don't have & in the field, so I'm pretty sure that is part of the problem.
But, I'm not sure how to deal with this. I am pretty sure I still want to analyze the field for full text search.
In addition, if I add a space before the * in the query (ie, "query": "A&B *",) then I get results including A&B, so I don't think it is just discarding the ampersand and treating the A and B as separate terms.
Should I change my mapping? The query?
The Query_string query has a set of reserved characters that needs to be escaped.
query_string : Read the reserved characters section
So to search for
'A&B' (or) 'A&B Corp' (or) 'A&B....'
Your query must be "A&B\\*" such that the query_string parser treats
it as a * wildcard operator.
While currently your query is searching for exact match of
"A&B*" it expects asterik to be part of your data.
And when you search "A&B *" the whitespace is a reserved
character so its
now searching for "A&B" (or) "*" and hence you get a match in this
case.
Given:
I loaded an instance into ElasticSearch which has its placeId property set to "Foo".
And I run the following searches:
{
"query": {
"term": {
"placeId": {
"value": "Foo"
}
}
}
}
{
"filter": {
"term": {
"placeId": "Foo"
}
}
}
{
"query": {
"match": {
"placeId": {
"query": "Foo"
}
}
}
}
But of these three, only the third one returned a result.
Why is this? Shouldn't they all have returned a result?
By default, using the standard analyzer, ES places your "Foo" in an index as "foo" (meaning, lowercased). When searching for term, ES doesn't use an analyzer so, it is actually searching for "Foo" (exact case). Whereas, in its index the "foo" exists (because of the analyzer).
The value passed for match instead is analyzed and ES is actually searching for "foo" in its indices, not "Foo" as it does with term.
So, the behavior you see is normal and this is how it's supposed to work.
Here about match:
A family of match queries that accept text/numerics/dates, analyzes it, and constructs a query out of it.
Here about term:
Matches documents that have fields that contain a term (not analyzed).
If u are not used an analyzer means elastic search term query and term query Filter should not support the Upper case Value. Please use "foo" in Your Query. please use this way
curl -XGET localhost:9200/index/incident/_search -d '{
"query":{
"term":{"field1":{"value":"value1"}
}}}'
but match all query is support upper and lower case.
Hope it will work.