In Elasticsearch, I know I can specify the fields I want to return from documents that match my query using {"fields":["fieldA", "fieldB", ..]}.
But how do I return the sum of all fields that match a particular regular expression (as a new field)?
For example, if my documents look like this:
{"documentid":1,
"documentStats":{
"foo_1_1":1,
"foo_2_1":5,
"boo_1_1:3
}
}
and I want the sum of all stats that match _1_ per document?
You can define an artificial field called script_field that contains a small Groovy script, which will do the job for you.
So after your query, you can add a script_fields section like this:
{
"query" : {
...
},
"script_fields" : {
"sum" : {
"script" : "_source.documentStats.findAll{ it.key =~ '_1_'}.collect{it.value}.sum()"
}
}
}
What the script does is simply to retrieve all the fields in documentStats whose name matches _1_ and sums all their values, in this case, you'll get 4.
Make sure to enable dynamic scripting in elasticsearch.yml and restart your ES node before trying this out.
Related
Is it possible to do conditional field query if match was not found for another field ?
for eg: if I have a 3 fields in the index local_rating , global_rating and default_rating , I need to first check in local_rating and if there is no match then try for global_rating and finally for default_rating .
is this possible to do with one query ? or any other ways to achieve this
thanks in advance
Not sure about any existing features of Elasticsearh to fulfill your current requirements but you can try with fields and per-fields boosting, Individual fields can be boosted with the caret (^)notation. Also I don't know boosting is possible with numeric value or not?
GET /_search
{
"query": {
"multi_match" : {
"query" : 10,
"fields" : [ "local_rating^6", "global_rating^3","default_rating"]
}
}
}
See: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-multi-match-query.html#field-boost
i have been using ES 5.x version and this is my sample data set json.
{"id":"1"}
{.... "company" : "HCL-US",....}
{"id":"2"}
{.... "company" : "HCL",....}
{"id":"3"}
{.... "company" : "HCL-IND",....}
{"id":"4"}
{.... "company" : "HCL-AUS",....}
How can i search and get who is belonging to "HCL-US". i tried using this query "_search?q=company:"HCL-US"" , it is returning HCL * result. How can i match exact string with special string.
You can use Term Query that matches exact term. Assuming company is a text field, you will get a keyword version of the same , following query should do the needful
{
"query": {
"term": {
"company.keyword": {
"value": "HCL-US"
}
}
}
}
1/ You can specify a whitespace analyzer in the mapping for the field company. This analyzer will split the query only on whitespace while the standard will split on non-alphanumeric characters.
The standard analyzer is the one used when no analyzer is defined.
2/ Or your can query on company.keyword which is a field automatically created for text field since 5.X . This keyword is not analyzed and you can safely use a term query on it to do exact matching.
I have documents like this:
{
title:'...',
body: '...'
}
I want to get documents which are more than 90% similar to the with a specific document. I have used this query:
query = {
"query": {
"more_like_this" : {
"fields" : ["title", "body"],
"like" : "body of another document",
"min_term_freq" : 1,
"max_query_terms" : 12
}
}
}
How to change this query to check for 90% similarity with specified doc?
Take a look at the Query Formation Parameter minimum_should_match
You should specify minimun_should_match
minimum_should_match
After the disjunctive query has been formed, this parameter controls
the number of terms that must match. The syntax is the same as the
minimum should match. (Defaults to "30%").
It form query using this
The MLT query simply extracts the text from the input document,
analyzes it, usually using the same analyzer at the field, then
selects the top K terms with the highest tf-idf to form a disjunctive
query of these terms
So if you would like to boost you title field you should boost your title field because if the title contains most of the terms present in the term frequency/ Inverse document frequency. the result should be boosted because it has more relevance. You can boost your title field by 1.5.
Refer this document for referenceren on the more_like_this query
I am newbie to elastic search
I have an education index in es
index creation
when i search 'btech' with match query as
"match" : { "name" : "btech" }
the result is like
result json object
but i need btech(exact match word) as the first document and remaining documents followed by it.
so for that what i have to change in my index creation
can anybody please help me
You can use term query
"term" : { "name" : "btech" }
Or regexp query
"regexp" : { "name" : "btech" }
You are using text type, make sure to check keyword type too
from documentation
If you need to index structured content such as email addresses,
hostnames, status codes, or tags, it is likely that you should rather
use a keyword field.
I am trying to get a simple startswith functionality in Elasticsearch. For example, I want the query "char" to match "charlotte", but I don't want it to match "dacharlotte". Using an edgeNgram filter gave me the latter result. I only want it to match results that START with the query terms, not just have them in them.
The simplest way to do what you want would be to use the prefix query:
{
"query": {
"prefix":{ "name" : "char" }
}
}
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-prefix-query.html