I'm able to perform exact match query by following Elasticsearch boolean query:
GET my_index/_search
{
"query": {
"bool": {
"filter": [
{
"term": {
"some_field.keyword": "some value"
}
}
]
}
}
}
some_field is indexed as default string type:
"some_field" : {
"properties" : {
"value" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
For some reason, I can only use Elasticsearch query_string. This means, I need equivalent query in Lucene syntax.
You can do the same way in query_string query with keyword variation of the field.
{
"query": {
"query_string": {
"query": "some value",
"default_field": "some_field.value.keyword"
}
}
}
Related
I have an index with a mapping something like this:
"email" : {
"type" : "nested",
"properties" : {
"from" : {
"type" : "text",
"analyzer" : "lowercase_keyword",
"fielddata" : true
},
"subject" : {
"type" : "text",
"analyzer" : "lowercase_keyword",
"fielddata" : true
},
"to" : {
"type" : "text",
"analyzer" : "lowercase_keyword",
"fielddata" : true
}
}
},
"textExact" : {
"type" : "text",
"analyzer" : "lowercase_standard",
"fielddata" : true
}
I want to use query_string to search for matches in both the nested and the non-nested field at the same time, e.g.
email.to:foo#example.com AND textExact:bar
But I can't figure out how to write a query that will search both fields at once. The following doesn't work, because query_string searches do not return nested documents:
"query": {
"query_string": {
"fields": [
"textExact",
"email.to"
],
"query": "email.to:foo#example.com AND textExact:bar"
}
}
I can write a separate nested query, but that will only search against nested fields. Is there any way I can use query_string to match both nested and non-nested fields at the same time?
I am using Elasticsearch 6.8. Cross-posted on the Elasticsearch forums.
Nested documents can only be queried with the nested query.
You can follow below two approaches.
1. You can combine nested and normal query in must clause, which works like "and" for different queries.
{
"query": {
"bool": {
"must": [
{
"nested": {
"path": "email",
"query": {
"term": {
"email.to": "foo#example.com"
}
}
}
},
{
"match": {
"textExact": "bar"
}
}
]
}
}
}
2. copy-to
The copy_to parameter allows you to copy the values of multiple fields into a group field, which can then be queried as a single field.
{
"mappings": {
"properties": {
"textExact":{
"type": "text"
},
"to_email":{
"type": "keyword"
},
"email":{
"type": "nested",
"properties": {
"to":{
"type":"keyword",
"copy_to": "to_email" --> copies to non-nested field
},
"from":{
"type":"keyword"
}
}
}
}
}
}
Query
{
"query": {
"query_string": {
"fields": [
"textExact",
"to_email"
],
"query": "to_email:foo#example.com AND textExact:bar"
}
}
}
Result
"_source" : {
"textExact" : "bar",
"email" : [
{
"to" : "sdfsd#example.com",
"from" : "a#example.com"
},
{
"to" : "foo#example.com",
"from" : "sdfds#example.com"
}
]
}
I have a strange behavior on elasticsearch that I cant explain.
When I do :
POST /ad_search/_search
{
"query": {
"match": {
"city_code": "2A247"
}
}
}
I have multiple result. But when I do (This code is generated by a librairies) :
POST /ad_search/_search
{
"from":0,
"query": {
"bool": {
"must":[
{"term":{"city_code":"2A247"}}
]
}
}
}
I have no result.
When I search on all other zip_code with only numbers like 71459. The both query are working well and give me the same result.
I was thinking of a mapping problems but it seems ok :
GET /ad_search/_mapping
{
"ad_search" : {
"mappings" : {
"properties" : {
"city_code" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
Someone have any ideas to unlock me ?
Thank you
It's because city_code is of type text and thus analyzed, hence what is being indexed is 2a247 (lowercase).
So you can either query city_code.keyword with a term query, which does an exact match
POST /ad_search/_search
{
"from":0,
"query": {
"bool": {
"must":[
{"term":{"city_code.keyword":"2A247"}}
]
}
}
}
Or with a match query on the city_code field:
POST /ad_search/_search
{
"from":0,
"query": {
"bool": {
"must":[
{"match":{"city_code":"2A247"}}
]
}
}
}
The mapping contains nested fields which shouldn't be analyzed (not sure if the 'not_analyzed' value is accurate). Is it possible to do an exact match on a nested field? In the query below the "metadata.value": "2014.NWJSD.47" still gets analyzed. Elasticsearch breaks up the string into several terms ("2014", "NWJSD", "47"). I tried to use "term" instead of "match" but this didn't return any result.
"mappings" : {
"metadata" : {
"type" : "nested",
"properties" : {
"name" : {
"type" : "text",
"index" : "not_analyzed"
},
"value" : {
"type" : "text",
"index" : "not_analyzed"
}
}
}
}
The Query:
"query": {
"bool": {
"must": [
{
"nested": {
"path": "metadata",
"query": {
"bool": {
"must": [
{
"match": {
"metadata.name": "number"
}
},
{
"match": {
"metadata.value": "2014.NWJSD.47"
}
}
]
}
}
}
}
]
}
}
Try to use keyword instead of text in your mapping like:
{
"mappings": {
"your_type_name": {
"properties": {
"metadata" : {
"type" : "nested",
"properties" : {
"name" : {
"type" : "keyword"
},
"value" : {
"type" :"keyword"
}
}
}
}
}
}
}
These fields won't be analyzed. Then you should reindex your data and to query your data you should replace match (which is analyzed query) with term.
{
"query": {
"bool": {
"must": [
{
"nested": {
"path": "metadata",
"query": {
"bool": {
"must": [
{
"term": {
"metadata.name": "number"
}
},
{
"term": {
"metadata.value": "2014.NWJSD.47"
}
}
]
}
}
}
}
]
}
}
}
I think you are looking for a query string query.
You can freely disable "analyze" option for that field in mapping option and reindex everything again but you could also check this query out:
as written here:
GET /_search
{
"query": {
"query_string" : {
"query" : "your string"
}
}
}
I am using keyword token analyzer in my elastic search given below
{
"settings" : {
"analysis" : {
"analyzer" : {
"default" : {
"type" : "keyword"
}
}
}
}
}
My order mapping is here
{
"order": {
"_all": {"enabled" : true},
"properties": {
"OrderData": {
"properties": {
"BusinessRuleData": {
.........
}
So now when I querying using the following json
{
"query": {
"bool": {
"must": [
{
"query_string": {
"default_field": "_all",
"query": "SomeText"
}
}
]
}
}
}
I dont get any results for this. Where as if I change my analyzer to "standard" then _all search works fine. Any answers are appreciated.
I think its probably indexed as whole. I think we have to search whole document which does not make sense. So the point is we have to use standard tokenizer for _all indexing.
I have defined mapping in following way.
PUT _template/name
"mappings": {
"_default_": {
"name": {
"type": "string",
"analyzer" : "synonyms_expand",
"index" : "analyzed",
"position_offset_gap": 100
},
}
}
I am executing following query
GET _search
{
"query": {
"bool": {
"should" : [{
"match_phrase": {
"petitioners.name": {
"query": "onkar kundargi "
}
}
}]
}
}
}
still it is giving result for only onkar. Not evaluting complete string for search. Can anybody help me ???