Elasticsearch: custom analyzer while querying - elasticsearch

Question

I am trying to supply analyzer at query time which is not working.
Create Index
PUT customer
Close Index and then Update index settings with analyzer configuration and Open Index
PUT customer_new/_settings
{
"settings": {
"analysis": {
"analyzer": {
"my_analyzer": {
"tokenizer": "my_tokenizer"
}
},
"tokenizer": {
"my_tokenizer": {
"type": "ngram",
"min_gram": 3,
"max_gram": 3,
"token_chars": [
"digit"
]
}
}
}
}
}
Query for data
GET customer/_search
{
"query": {
"match": {
"phonenumber": { "query":"678",
"analyzer": "my_analyzer"
}
}
}
}
But this does not return any results.
On explaining the query
POST customer/_validate/query?explain
{
"query": {
"match": {
"phonenumber": { "query":"678",
"analyzer": "my_analyzer"
}
}
}
}
{
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"valid": true,
"explanations": [
{
"index": "customer",
"valid": true,
"explanation": "phonenumber:678"
}
]
}
The reason I am updating index is that i have index already in place. What i want to do is i can receive different ways to search on a field so i want to add analyzers on the fly and then use them while querying.
I think if i reindex and have this analyzer configured in phonenumber field by update the mapping , this will work. But like i mentioned above i dont want to reindex as there are millions of records and frequently reindexing is not a option.
Is there a way to solve this?

Answer 1

Short answer: You will have to reindex your documents
When you specify an analyzer in the query, the text in the query will use this analyzer, not the field in the document.
For example, if you index "Hello" using default analyzer and search "Hello" using an analyzer without lowercase, you will not get a result because you will try to match "Hello" with "hello" (i.e., lowercase).
The only solution to apply a new mapping is to reindex the documents. You cannot reindex only the field whose mapping changed.
It might not be the solution that you are looking for but here is a few hint to handle this problem:
If you use ngram analyzer to search within the term, you can use a wildcard query with *<SEARCH_TERM>*. 234 will match 12345. You will not have to create a new analyzer because you just change the query. Please note that it will come with an important query overhead.
Instead of reindex the whole index, just create a subset of documents. This can be easily done with the _reindex endpoint. Test and improve your mapping using only this subset and once you are happy with the result, reindex all the documents.
If you do not use them already, use alias to make reindexing transparent for the application.