Given:
I loaded an instance into ElasticSearch which has its placeId property set to "Foo".
And I run the following searches:
{
"query": {
"term": {
"placeId": {
"value": "Foo"
}
}
}
}
{
"filter": {
"term": {
"placeId": "Foo"
}
}
}
{
"query": {
"match": {
"placeId": {
"query": "Foo"
}
}
}
}
But of these three, only the third one returned a result.
Why is this? Shouldn't they all have returned a result?
By default, using the standard analyzer, ES places your "Foo" in an index as "foo" (meaning, lowercased). When searching for term, ES doesn't use an analyzer so, it is actually searching for "Foo" (exact case). Whereas, in its index the "foo" exists (because of the analyzer).
The value passed for match instead is analyzed and ES is actually searching for "foo" in its indices, not "Foo" as it does with term.
So, the behavior you see is normal and this is how it's supposed to work.
Here about match:
A family of match queries that accept text/numerics/dates, analyzes it, and constructs a query out of it.
Here about term:
Matches documents that have fields that contain a term (not analyzed).
If u are not used an analyzer means elastic search term query and term query Filter should not support the Upper case Value. Please use "foo" in Your Query. please use this way
curl -XGET localhost:9200/index/incident/_search -d '{
"query":{
"term":{"field1":{"value":"value1"}
}}}'
but match all query is support upper and lower case.
Hope it will work.
Related
I have a match_phrase_prefix query, which works as expected. But when the users passes any special characters at the end of the keyword, ES ignores these characters, and still returns the result.
query{ match_phrase_prefix:{ content: { query: searchTerm } } }
I am using this query to search for prefix. If i pass a term like overflow####!! ES is returning me all the results with the word overflow in it. But instead i want to make an exact prefix match, where the special characters are not ignored. The search term could be of multiple words as well stack overflow search.
How could i make ES search of prefix_match without ignoring the special_chars.
You can use keyword analyzer when defining your query.
{
"query": {
"match_phrase_prefix": {
"content": {
"query": "overflow####!!",
"analyzer": "keyword"
}
}
}
}
I have a field named "tag" which is analyzed(default behavior) in elasticsearch. The "tag" field can have a single word or a comma separated string to store multiple tags. For eg. "Festive, Fast, Feast".
Now for example if a tag is "Festive", before indexing I am converting it to small case(to ignore case sensitivity) and indexing it as "festive".
Now if I search using a match query with all caps letters as mentioned below I get results fine(as expected).
{
"query": {
"match": {
"tag": "FESTIVE"
}
}
}
But if I do a wildcard query as mentioned below I don't get results :(
{
"query": {
"wildcard": {
"tag": {
"value": "F*"
}
}
}
}
If I change the value field in wildcard search to "f*" instead of "F*" then I get results.
Does anyone have any clue why is wildcard query behaving case sensitive?
Wildcard queries, fall under term level queries and hence not analyzed. From the Docs
Matches documents that have fields matching a wildcard expression (not
analyzed)
You will get expected results with query string query, it will lowercase the terms because by default as lowercase_expanded_terms is true. Try this
GET your_index/_search
{
"query": {
"query_string": {
"default_field": "tag",
"query": "F*"
}
}
}
Hope this helps!
When I call this URL:
http://192.168.x.x:9200/identities/work/_search?q=joh*
ES is returning a limited (5) set of matches, starting with some indexes of people names John and Johnny etc. That seems to be the correct result.
But when I send this JSON to ES:
{
"query": {
"match": {
"_all": "joh*"
}
}
}
I get results that I can't even logically explain. Seems rather random, and a lot of indexes too (hundreds, not a lot of johns and johnny's either ;))
Is this not the equivalent of the URL mentioned above? What am I doing wrong?
When you call the following URL, what ES does implicitly is to create a query_string query not a match query
http://192.168.x.x:9200/identities/work/_search?q=joh*
So the equivalent JSON query would be:
{
"query": {
"query_string": {
"query": "joh*"
}
}
}
Moreover, match queries do not handle wildcards as in joh*, the * is considered and matched as a real character, not as a wildcard.
I've inserted a record in ElasticSearch an I can see that here:
But this query returns nothing:
{
"query": {
"filtered": {
"query": {
"bool": {
"must": {
"term": {
"name": "Ehsanl"
}
}
}
}
}
}
}
I post this query using post method to this user: http://127.0.0.1:9200/mydb/customers2/_search
What's wrong with that?
Try giving the name as "ehsanl". All in lower case.
What you see on your screenshot is the original document as you indexed it (_source field).
However, by default, string fields are analyzed (see this answer for more detail about analysis).
Using standard analyzer, your name value should have been lowercased to ehsanl and stored this way in the index : term queries search for the exact value Ehsanl in the index, which doesn't exist.
You can either :
use ehsanl value with term query
use Ehsanl value with a match query, which will apply the same analyzer before to search.
This query is returning fine only one item "steve_jobs".
{
"query": {
"constant_score": {
"filter": {
"term": {
"name":"steve_jobs"
}
}
}
}
}
So, now I want to get all people with name prefix steve_. So I try this:
{
"query": {
"constant_score": {
"filter": {
"term": {
"name": "steve_"
}
}
}
}
}
This is returning nothing. Why?
I'm confused about when to use term query / term filter / terms filter / querystring query.
What you need is Prefix Query.
If you are indexing your document like so:
POST /testing_nested_query/class/
{
"name": "my name is steve_jobs"
}
And you are using the default analyzer, then the problem is that the term steve_jobs will be indexed as one term. So your Term Query will never be able to find any docs matching the term steve as there is no term like in the index. Prefix Query helps you solve your problem by searching for a prefix in all the indexed terms.
You can solve the same problem by making your custom analyzers (read this and this) so that steve_jobs is stored as steve and jobs.