I face the problem about writing Elasticsearch query.
My query is like below
{
"query": {
"query_string": {
"default_field": "content",
"query": "#lin1"
}
},
"from": 0,
"size": 1000,
"sort": [
{
"time": "desc"
}
]
}
And I am using query_string
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html
But the # character can not match.
It will come out this kind of result: lin1 or 「lin1」
So how should I write the Elasticsearch query to match #lin1?
It all depends on the analyzer you are using. For all you know, you are using the standard analyzer which discards the '#' symbol from the index. In that case, you'll never be able to search for the '#' symbol. But if that is not the case and you do have '#' indexed, you can modify the query_string section of your query to below:
"query_string": {
"default_field": "content",
"query": "#lin1",
"analyzer": "whitespace"
}
Related
I have a word index and I can't search phrases on elasticsearch. there is no result. I check tons of solutions but I can't implement them to my query.
My mapping looks like this;
PUT /words/_mapping
{
"properties": {
"text": {
"type": "keyword"
}
}
}
(if the type is text everything worked as expected)
My elastic query looks like this;
GET /words/_search
{
"from": 0,
"query": {
"bool": {
"filter": [
{
"bool": {
"should": [
{
"query_string": {
"default_field": "text",
"default_operator": "AND",
"query": "*foo bar baz*"
}
}
]
}
}
]
}
},
"size": 100,
"track_total_hits": true
}
But there is no data
_id
_index
_score
_type
text
I expect the record that has `foo bar baz` value,
_id
_index
_score
_type
text
drDzzYQBu3ncIuw4vn10
words
0.0
_doc
foo bar baz
What is the problem? Could someone help?
"Query_string" is a full text query and will be optimized for text fields only , I suggest you to to use text type instead of keyword for this query.
As you are using AND operator , it will treat as phrase only.
I have a record in my ElasticSearch index with the term "cleveland". When I do this search:
"query": {
"multi_match": {
"fields": [
"firstname^3",
"lastname^3",
"home_address",
"home_city"
],
"query": "clevela",
"fuzziness": "AUTO"
}
},
it successfully finds the term. The missing two characters are within the fuzziness threshold. But I'd like to support the extended query syntax of simple_query_string (+, -, phrase search, etc.) So I tried this syntax:
"query": {
"simple_query_string": {
"query": "clevela",
"fields": [
"firstname^3",
"lastname^3",
"home_address",
"home_city"
],
"lenient": true
}
},
and it does not find the term. Fuzziness appears to be turned off. How do I turn it on?
In a simple query string, you need to specify the fuzziness parameter, by adding ~N (N is the max edit distance) after the search term. Modify your search query as
{
"query": {
"simple_query_string": {
"query": "clevela~2", // note this
"fields": [
"firstname^3",
"lastname^3",
"home_address",
"home_city"
],
"lenient": true
}
}
}
I have the fallowing part of a mapping:
"name": {
"store": "true",
"type": "keyword"
}
and this query:
{
"query":{
"query_string":{
"query":"+(name:John Doe)",
"fields":[
]
}
},
"aggregations":{
"name":{
"terms":{
"field":"name",
"size":10
}
}
}
}
The query should return over 100 results however it only returns a few. If I add quotes to John Doe like this: \"John Doe\" then it returns all the desired results.
I'm wondering why this happens. Isn't enough that the field is mapped as keyword so that John Doe is analyzed as a whole, and no quotes should be added? Also, why would it return less items without quotes?
Note: In ES 1.4 the same query seems to work fine (although is not the same data to be honest, and it uses facets instead of aggregations).
The documentation for query string query clearly states:
If the field is a keyword field the analyzer will create a single term ...
So you don't need to add quotes to your search string. Instead, you need to write your query correctly. Currently your query try to find the term John in field name, and term Doe in all other fields! So you must rewrite your query in one of the following ways:
Add parentheses to your search term so the query parser can "understand" that all words must be found in name field:
{
"query": {
"query_string": {
"query": "+(name:(John Doe))",
"fields": [
]
}
},
"aggregations": {
"name": {
"terms": {
"field": "name",
"size": 10
}
}
}
}
Specify field name in fields array rather than in query string:
{
"query": {
"query_string": {
"query": "+(John Doe)",
"fields": [
"name"
]
}
},
"aggregations": {
"name": {
"terms": {
"field": "name",
"size": 10
}
}
}
}
I have indexed documents with metadata "User_Id" containing data "A"
and "B". I'm trying to check documents "A NOT B". I am not able to get the desired output. I am restricted to not use "query string query" and use "NOT" operator.
Doesn't must_not support multi_match?
{
"from": 0,
"size": 24,
"query": {
"bool": {
"must": [
{
"multi_match": {
"query": "A",
"fields": ["User_Id"],
"fuzziness": "AUTO"
}
}
],
"must_not" :[
{
"multi_match": {
"query": "B",
"fields": ["User_Id"],
"fuzziness": "AUTO"
}
}
]
}
}
}
You need to remove the fuzziness auto. This setting allows approximation in the string: a query "AUTO13273" with fuzziness "AUTO" will match AUTO13272 and AUTO13273 since the distance between those two strings is only 1.
See the fuzziness documentation here
I am searching across multiple fields in a query using the * asterisk notation (Ex: I want all fields startings with source so I specify fields source.*) and I specify a query of foobar as string. I am using a Query String type query.
I keep getting a NumberFormatException and I have some fields in there with a mapping type of long and double.
Any idea how to go about this? I need to do a multi-field search.
My query is posted below:
{
"query": {
"bool": {
"must": [{
"query_string": {
"default_field": "source.*",
"query": "foobar"
}
}],
"must_not": [],
"should": []
}
},
"from": 0,
"size": 100000,
"sort": [],
"facets": {}
}
set lenient to true to ignore format based failures
example :
"query_string":
{
"default_field": "source.*",
"query": "foobar",
"lenient": true
}