I need to search in elasticsearch like
select * from tablename where file.content='xyz' and filePermission.Id='abc'
What query I need to add. Is it possible to give a filter to search query? I have set file.content as a default field.
AND SQL queries can be written as a "must bool query":
{
"query" : {
"bool" : {
"must" : [
{ "match" : { "file.content":"xyz"} },
{ "match" : { "filePermission.Id" : "abc"} }
]
}
}
}
Related
i have tried the multiple field query and it works fine. But I would like to know what other options are generally used to query multiple fields in elasticsearch?
Structured queries with multiple terms, for finding exact values, the same as SQL
https://www.elastic.co/guide/en/elasticsearch/guide/current/_finding_multiple_exact_values.html
"bool" : {
"must" : [
{ "term" : { "tags" : "search" } },
{ "term" : { "tag_count" : 1 } }
]
}
For example, consider following sql query,
SELECT product
FROM products
WHERE (price = 20 OR productID = "XHDK-A-1293-#fJ3")
AND (price != 30)
In these situations, you will need the bool filter. This is a compound filter that accepts other filters as arguments, combining them in various Boolean combinations.
The Query DSL would be,
GET /my_store/products/_search
{
"query" : {
"filtered" : {
"filter" : {
"bool" : {
"should" : [
{ "term" : {"price" : 20}},
{ "term" : {"productID" : "XHDK-A-1293-#fJ3"}}
],
"must_not" : {
"term" : {"price" : 30}
}
}
}
}
}
}
Follow the below link for documentation
https://www.elastic.co/guide/en/elasticsearch/guide/current/combining-filters.html
I want to write a query in elasticsearch only for scoring can anybody please tell me how can i do that my query is given below also "minimum_should_match": 0 is not working with should, if any query matches both area2 and area1 then i want to boost the score of the result now how can i achieve that can anybody tel me the final query which i should write ??
query: {
bool: {
must: [
{
query_string: {
query: shop_search,
fields: ['shop_name'],
boost: 30.0
}
},
{
bool: {
should: [
{
term : { 'address.area2' : search_area2 },
term : { "address.area1" : search_area1 }
},
"minimum_should_match" : 0,
],
}
}
]
}
Do you want to get all records that match the shop search and boost the results where the the address.area1 and/or address.area2 field values match the area searches?
The syntax you are using for the bool is off. The match clause needs to be fixed up to fit Elasticsearch's expectations and the extra nested bool should not be necessary. See Elasticsearch Bool Query.
{
"query" : {
"bool" : {
"must" : {
"query_string" : {
"query" : <SHOP_SEARCH>,
"fields" : ['shop_name']
}
},
"should" : [
{
"match" : {
"address.area1" : {
"query" : <SEARCH_AREA1>,
"operator" : "and",
"boost" : <CUSTOM_BOOST1>
}
}
},
{
"match" : {
"address.area2" : {
"query" : <SEARCH_AREA2>,
"operator" : "and",
"boost" : <CUSTOM_BOOST2>
}
}
}
]
}
}
}
I think with that query, you can expect the the following:
only results that match the shop search
results that do not match on the area fields but do match the shop search - this is due to the presence of the match clause
order of the results will generally be results that match both areas first, followed by results that match one of the areas, followed by results that match neither of the areas - but no guarantees. Learn more about Elasticsearch scoring
You might want to review everything you are getting with query_string.
I am trying to find ElasticSearch query equivalent to IN \ NOT in SQL.
I know we can use QueryString query with multiple OR to get the same answer, but that ends up with lot of OR's.
Can anyone share the example?
Similar to what Chris suggested as a comment, the analogous replacement for IN is the terms filter (queries imply scoring, which may improve the returned order).
SELECT * FROM table WHERE id IN (1, 2, 3);
The equivalent Elasticsearch 1.x filter would be:
{
"query" : {
"filtered" : {
"filter" : {
"terms" : {
"id" : [1, 2, 3]
}
}
}
}
}
The equivalent Elasticsearch 2.x+ filter would be:
{
"query" : {
"bool" : {
"filter" : {
"terms" : {
"id" : [1, 2, 3]
}
}
}
}
}
The important takeaway is that the terms filter (and query for that matter) work on exact matches. It is implicitly an or operation, similar to IN.
If you wanted to invert it, you could use the not filter, but I would suggest using the slightly more verbose bool/must_not filter (to get in the habit of also using bool/must and bool).
{
"query" : {
"bool" : {
"must_not" : {
"terms" : {
"id" : [1, 2, 3]
}
}
}
}
}
Overall, the bool compound query syntax is one of the most important filters in Elasticsearch, as are the term (singular) and terms filters (plural, as shown).
1 terms
you can use terms term query in ElasticSearch that will act as IN
terms query is used to check if the value matches any of the provided values from Array.
2 must_not
must_not can be used as NOT in ElasticSearch.
ex.
GET my_index/my_type/_search
{
"query" : {
"bool" : {
"must":[
{
"terms": {
"id" : ["1234","12345","123456"]
}
},
{
"bool" : {
"must_not" : [
{
"match":{
"id" : "123"
}
}
]
}
}
]
}
}
}
exists
Also if it helps you can also use "exists" query to check if the field exists or not.
for ex,
check if the field exists
"exists" : {
"field" : "mobileNumber"
}
check if a field does not exist
"bool":{
"must_not" : [
{
"exists" : {
"field" : "mobileNumber"
}
}
]
}
I saw what you requested.
And I wrote the source code as below.
I hope this helps you solve your problem.
sql query :
select * from tablename where fieldname in ('AA','BB');
elastic search :
{
query :{
bool:{
must:[{
"script": {
"script":{
"inline": "(doc['fieldname'].value.toString().substring(0,2).toUpperCase() in ['AA','BB']) == true"
}
}
}],
should:[],
must_not:[]
}
}
}
I wrote the following query to fetch records from an Elastic Search cluster.
{
"query" : {
"query_string" : {
"query" : "One Record"
}
},
"explain" : true
}
However, later I found out that the following query also produces the same results.
{
"query" : {
"bool" : {
"should" : {
"query_string" : {
"query" : "One Record"
}
}
}
},
"explain" : true
}
Will both the above queries always produce the same results?
A bool query merely combines other types of queries and adds over the scores , hence the above two queries will always give the same result.
I've had good success getting results for searches using the below syntax, but I'm having trouble adding a boolean condition.
http://localhost:9200/index_name/type_name/_search?q=test
My documents look like:
{
"isbn":"9780307414922",
"name":"Dark of the Night",
"adult":false
}
Here's my best guess as to how to achieve what I'm trying to do.
{
"query_string": {
"default_field": "_all",
"query": "test"
},
"from": 0,
"size": 20,
"terms": {
"adult": true
}
}
However this results in "Parse Failure [No parser for element [query_string]]]; }]"
I'm using elastic search 0.20.5.
How can I match documents containing a search term the way "?q=test" does and filter by the document's adult property?
Thanks in advance.
Your adult == true clause has to be part of the query - you can't pass in a term clause as a top level parameter to search.
So you could add it to the query as a query clause, in which case you need to join both query clauses using a bool query, as follows:
curl -XGET 'http://127.0.0.1:9200/_all/_search?pretty=1' -d '
{
"query" : {
"bool" : {
"must" : [
{
"query_string" : {
"query" : "test"
}
},
{
"term" : {
"adult" : true
}
}
]
}
},
"from" : 0,
"size" : 20
}
'
Really, though, query clauses should be used for:
full text search
clauses which affect the relevance score
However, your adult == true clause is not being used to change the relevance, and it doesn't involve full text search. It's more of a yes/no response, in other words it is better applied as a filter clause.
This means that you need to wrap your full text query (_all contains test) in a query clause which accepts both a query and a filter: the filtered query:
curl -XGET 'http://127.0.0.1:9200/_all/_search?pretty=1' -d '
{
"query" : {
"filtered" : {
"filter" : {
"term" : {
"adult" : true
}
},
"query" : {
"query_string" : {
"query" : "test"
}
}
}
},
"from" : 0,
"size" : 20
}
'
Filters are usually faster because:
they don't have to score documents, just include or exclude them
they can be cached and reused