I am trying to make a query to search documents with ID = "CASE_CREATE_DATE#10000078". If i am using below query then it is working.
{
"query": {
"match" : {
"EVENTS.ID" : "CASE_CREATE_DATE#10000078"
}
}
}
but when i am using same query with bool then it is not working.
Bool Query i am using:
{
"query": {
"bool": {
"must": [
{
"term": {
"EVENTS.ID": {
"value": "CASE_CREATE_DATE#10000078",
"boost": 1
}
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
}
}
Please help me what is wrong with my bool query.
You're not searching for the same value (CASE_CREATE_DATE#10000078 vs true) and you're using term instead of match
The following query will work:
{
"query": {
"bool": {
"must": [
{
"match": {
"EVENTS.ID": {
"value": "CASE_CREATE_DATE#10000078",
"boost": 1
}
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
}
}
Related
I have the following ES query :
{
"query": {
"bool": {
"should": [
{
"constant_score": {
"boost": 5,
"filter": {
"bool": {
"must": [
{
"ids": {
"values": [
"winnerAthlete-A"
]
}
},
{
"dis_max": {
"queries": [
{
"bool": {
"filter": {
"term": {
"isAthlete": true
}
}
}
},
{
"bool": {
"filter": {
"term": {
"isWinner": true
}
}
}
}
]
}
}
]
}
}
}
},
{
"constant_score": {
"boost": 4,
"filter": {
"bool": {
"must": [
{
"ids": {
"values": [
"winnerAthlete-B"
]
}
},
{
"dis_max": {
"queries": [
{
"bool": {
"filter": {
"term": {
"isAthlete": true
}
}
}
},
{
"bool": {
"filter": {
"term": {
"isWinner": true
}
}
}
}
]
}
}
]
}
}
}
}
]
}
}
}
It does return the result I expect : the 2 documents winnerAthlete-A and winnerAthlete-B, assigning a score of 5.0 to winnerAthlete-A and a score of 4.0 to winnerAthlete-B.
Now, when I turn the should on the third line of the query into a must, the query does not match any document whereas I would expect the exact same result. I can't wrap my head around why. I have tried using the ES _explain keyword to understand why this query doesn't match when using must but it didn't help me.
Any idea why this query rewritten with a must does not return anything whereas the should version does return the expected result ?
Should works like "OR" . It will return a document which matches any of clauses.
Must works like "AND" . Document must satisfy both clauses.
Your query is not returning any result because there is no single document which has ids as winnerAthlete-A as well as winnerAthlete-B
Good day together,
I have a little problem in Elastic/Kibana. In the Kibana Query Language "KQL" it is possible for me to execute a certain query:
car:* AND coun: * AND doc: (bes* OR *rvr*) AND NOT coun: (SIP OR LUK)
I would like to use this as a filter query using Elasticscearch query DSL. Only I don't get the same result. For this I use the boolean operator. My query looks like this:
{
"query": {
"bool": {
"must": [
{
"exists": {
"field": "car"
}
},
{
"exists": {
"field": "coun"
}
}
],
"should": [
{
"wildcard": {
"doc.keyword": {
"value": "bes*"
}
}
},
{
"wildcard": {
"doc.keyword": {
"value": "*rvr*"
}
}
}
],
"must_not": [
{
"term": {
"coun.keyword": "SIP"
}
},
{
"term": {
"coun.keyword": "LUK"
}
}
],
"minimum_should_match": 1
}
}
}
Unfortunately, I do not get the same result. My guess is the "should" operator. But I don't know exactly how to adjust the code.
I would be very grateful for any answer! Thanks a lot!
Problem here, that you putting OR outside AND. Just move should clause inside must. Like this
GET _search
{
"query": {
"bool": {
"must": [
{
"exists": {
"field": "car"
}
},
{
"exists": {
"field": "con"
}
},
{
"bool": {
"should": [
{
"wildcard": {
"doc.keyword": {
"value": "bes*"
}
}
},
{
"wildcard": {
"doc.keyword": {
"value": "*rvr*"
}
}
}
]
}
}
],
"must_not": [
{
"term": {
"coun.keyword": "SIP"
}
},
{
"term": {
"coun.keyword": "LUK"
}
}
],
"minimum_should_match": 1
}
}
}
I have a simple document where the _source looks like:
{
"name" : "myProduct",
"label" : "isApiisApi",
"isApi" : 1,
"sold" : 0
}
I've been trying to create a multiple condition query using bool. The only way that I get it working was by using a match query:
{
"query": {
"bool": {
"must": [
{ "term": { "sold": 0 } },
{ "term": { "isApi": 1 } },
{ "match": { "name": "myProduct" } }
]
}
}
}
But why doesn't it work when I use the term query (as the final condition):
{
"query": {
"bool": {
"must": [
{ "term": { "sold": 0 } },
{ "term": { "isApi": 1 } },
{ "term": { "name": "myProduct" } }
]
}
}
}
Tldr;
Elastic text fields upon ingestion passes the data into a analyzer.
By default the standard analyzer is used. Which comes with a token filter named Lowercase.
Your text is indexed in lowercase.
But you are using a term which search for exact match on the indexed data.
In your case myproduct =/= myProduct.
To Reproduce
By default Elastic index, all string like data in two fields.
text
keyword
For exact match you want to use the keyword version.
See below:
POST /72020272/_doc
{
"name" : "myProduct",
"label" : "isApiisApi",
"isApi" : 1,
"sold" : 0
}
GET /72020272/_mapping
GET /72020272/_search
{
"query": {
"bool": {
"must": [
{ "term": { "sold": 0 } },
{ "term": { "isApi": 1 } },
{ "term": { "name": "myProduct" } }
]
}
}
}
GET /72020272/_search
{
"query": {
"bool": {
"must": [
{ "term": { "sold": 0 } },
{ "term": { "isApi": 1 } },
{ "term": { "name.keyword": "myProduct" } }
]
}
}
}
Thanks for the answer in advance.
I am running a query
SELECT key
FROM records_index
WHERE
(product_nested_field.code = '1234' and product_nested_field.codeset = 'category1' OR product_nested_field.code = '444' and product_nested_field.codeset = 'category1')
AND (role_name IN ('user', 'admin'))
GROUP BY records_uuid
In records_index I have record with two products
[
{codeset: category1, code:444},
{codeset: category2, code:1234}
]
The problem is that query does find a specified record.
such behavior is expected for "type": "object" but why I am getting that result for product_nested_field of type nested?
when I translate SQL to JSON I am getting
{
"bool": {
"must": [
{
"bool": {
"must": [
{
"nested": {
"query": {
"term": {
"product_nested_field.codeset": {
"value": "category1"
}
}
}
}
}
]
}
},
{
"bool": {
"must": [
{
"bool": {
"should": [
{
"nested": {
"query": {
"term": {
"product_nested_field.code": {
"value": "1234"
}
}
}
}
},
{
"nested": {
"query": {
"term": {
"product_nested_field.code": {
"value": "444"
}
}
}
}
}
]
}
}
]
}
}
],
"adjust_pure_negative": true,
"boost": 1.0
}
}
why elastic moves product_nested_field.codeset = 'category1' into separate nested query.
Having a problem getting record with intersecting ('and') condition.
I have a doc:
{
"uuid": "1e2a0c06-af24-42e1-a31a-0f84233521de",
"subject": "subj",
"relations": [
{
"userUuid": "0f38e576-6b1f-4c1a-86a8-67a55a06d504",
"signed": false
},
{
"userUuid": "15979293-6b04-41a9-a6aa-bba99499496f",
"signed": true
}
]
}
Querying and expecting to get EMPTY result, cause conditions are met from different nested elements:
"bool": {
"must": [
{
"nested": {
"query": {
"term": {
"relations.userUuid": {
"value": "15979293-6b04-41a9-a6aa-bba99499496f",
"boost": 1.0
}
}
},
"path": "relations",
"ignore_unmapped": false,
"score_mode": "none",
"boost": 1.0
}
},
{
"nested": {
"query": {
"term": {
"relations.signed": {
"value": false,
"boost": 1.0
}
}
},
"path": "relations",
"ignore_unmapped": false,
"score_mode": "none",
"boost": 1.0
}
}
],
"adjust_pure_negative": true,
"boost": 1.0
}
}
How to query that condition would be 'AND' within same nested object?
Updated the answer looking at your comment. You need to mention path in your nested document.
Scenario 1: If you want any of the nested documents to contain 5979293-6b04-41a9-a6aa-bba99499496f as userUuid and signed as true
POST <your_index_name>/_search
{
"query": {
"bool": {
"must": [
{
"nested": {
"path": "relations", <---- Note this
"query": {
"term": {
"relations.userUuid": "15979293-6b04-41a9-a6aa-bba99499496f"
}
}
}
},
{
"nested": {
"path": "relations",
"query": {
"term": {
"relations.signed": false
}
}
}
}
]
}
}
}
This would return true if there are two nested documents, first nested doc containing the userUuid and second nested doc containing signed as false
Scenario 2: If you want both the fields to be present in a single nested document
POST <your_index_name>/_search
{
"query": {
"bool": {
"must": [
{
"nested": {
"path": "relations", <---- Note this
"query": {
"bool": {
"must": [
{
"term": {
"relations.userUuid": "15979293-6b04-41a9-a6aa-bba99499496f"
}
},
{
"term": {
"relations.signed": false
}
}
]
}
}
}
}
]
}
}
}
In this scenario, a single nested document must contain both values.
Let me know if this helps!