I am using elasticsearch v0.90.5 and trying to set QueryName (_name) for a has_child query as described here: http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/search-request-named-queries-and-filters.html
But the has_child queries are failing if queryName is set. They also fail if queryName is set on a wrapping query. You can find the curl recreation here: https://gist.github.com/hmrizin/9645816
"query": {
"has_child": {
"query": {
"term": {
"postid": "p1"
}
},
"child_type": "post",
"_name": "somename"
}
}
and
"query": {
"bool": {
"should": {
"has_child": {
"query": {
"term": {
"postid": "p2"
}
},
"child_type": "post"
}
},
"_name": "somename"
}
}
The error that both cause is the same:
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 4,
"failed" : 1,
"failures" : [ {
"index" : "twtest",
"shard" : 1,
"status" : 500,
"reason" : "ElasticSearchIllegalStateException[has_child filter hasn't executed properly]"
} ]
},
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [ ]
}
}
What am I missing?
Having just run this with v1.0.1, it worked as-is without any changes.
However, I downloaded v0.90.5 and it got the error that you posted unless I removed the _name. It looks like you came across a bug, and in the very next release, v0.90.6, the entire class to blame (HasChildFilter) was refactored into other code.
v0.90.5 package: org.elasticsearch.index.search.child
v0.90.6 package: org.elasticsearch.index.search.child
It looks like you came across a bug that also existed in v0.90.4 (I verified), which is when the feature was added. Unfortunately, I think the solution to your problem is to upgrade your installation of Elasticsearch to at least v0.90.6. Based on its patch notes, they may not even have been aware of the error that they fixed, but I was able to verify that it was fixed in that release.
Related
According to Official 7.x document Link
While a field is deemed non-existent if the JSON value is null or [],
these values will indicate the field does exist:
Empty strings, such as "" or "-" Arrays containing null and another
value, such as [null, "foo"] A custom null-value, defined in field
mapping
However, My es not consider "" as not existed.
Here is my Data:
"_source" : {
"chat_msg" : {
"action" : "send",
"from" : "t",
"msgid" : "6505946507184390735_161_external",
"msgtime" : 1623396135015,
"msgtype" : "text",
"roomid" : "",
Now, When I do Query As :
GET enterprise_chat_data/_search
{
"query": {
"bool": {
"must_not": [
{
"exists": {
"field": "chat_msg.roomid"
}
}
]
}
}
}
Result:
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 2,
"successful" : 2,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
}
}
It Hit Nothing. Am I Wrong About Something?
I think you have misunderstood the documentation. In the documentation, it is written that if a field have value as empty strings, such as "" or "-", then that field will be considered to be existing.
Due to this when you are querying for must_not exists query for "chat_msg.roomid" field, you are getting empty results, as in the data you have indexed the value of "chat_msg.roomid" field as ""
Update 1:
You can use term query to search for documents having field value of chat_msg.roomid as ""
{
"query": {
"term": {
"chat_msg.roomid.keyword": ""
}
}
}
The question is based on the previous post where the Exact Search did not work either based on Match or MatchPhrasePrefix.
Then I found a similar kind of post here where the search field is set to be not_analyzed in the mapping definition (by #Russ Cam).
But I am using
package id="Elasticsearch.Net" version="7.6.0" targetFramework="net461"
package id="NEST" version="7.6.0" targetFramework="net461"
and might be for that reason the solution did not work.
Because If I pass "SOME", it matches with "SOME" and "SOME OTHER LOAN" which should not be the case (in my earlier post for "product value").
How can I do the same using NEST 7.6.0?
Well I'm not aware of how your current mapping looks. Also I don't know about NEST as well but I will explain
How to make Elastic Engine understand a field is not to be analyzed for an exact match?
by an example using elastic dsl.
For exact match (case sensitive) all you need to do is to define the field type as keyword. For a field of type keyword the data is indexed as it is without applying any analyzer and hence it is perfect for exact matching.
PUT test
{
"mappings": {
"properties": {
"field1": {
"type": "keyword"
}
}
}
}
Now lets index some docs
POST test/_doc/1
{
"field1":"SOME"
}
POST test/_doc/2
{
"field1": "SOME OTHER LOAN"
}
For exact matching we can use term query. Lets search for "SOME" and we should get document 1.
GET test/_search
{
"query": {
"term": {
"field1": "SOME"
}
}
}
O/P that we get:
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 0.6931472,
"hits" : [
{
"_index" : "test",
"_type" : "_doc",
"_id" : "1",
"_score" : 0.6931472,
"_source" : {
"field1" : "SOME"
}
}
]
}
}
So the crux is make the field type as keyword and use term query.
I have a question about Elasticsearch
I made a search query about the phone number. My plan is that even I don't put the hyphen or bracket, result would show the phone number.
For example,
phone number is (213)234-1111
and
search query is
GET _msearch
{ "query": {"fuzzy": { "tel": {"value": "2132341111", "max_expansions" : 100}}}}
the result is
{
"took" : 0,
"responses" : [
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"status" : 200
}
]
}
I need a help that even I put the number without bracket and hyphen, the result show the real phone number with information.
To allow efficient querying, make sure to index the documents accordingly.
In this example that I just made, I am making sure that phone-numbers are indexed without the hyphens and parenthesis. This allows me to query without using those characters as well.
Example:
(1) Create the index:
PUT my_index
{
"settings": {
"analysis": {
"analyzer": {
"default": {
"tokenizer": "standard",
"char_filter": [
"my_char_filter"
]
}
},
"char_filter": {
"my_char_filter": {
"type": "pattern_replace",
"pattern": "\\((\\d+)\\)(\\d+)-(\\d+)",
"replacement": "$1$2$3"
}
}
}
}
}
(2) Add a document to the index:
POST my_index/doc
{
"Description": "My phone number is (213)234-1111"
}
(3) Query with the original phone number:
GET my_index/_search
{
"query": {
"match": {
"Description": "(213)234-1111"
}
}
}
(1 result)
(4) Query without special characters:
GET my_index/_search
{
"query": {
"match": {
"Description": "2132341111"
}
}
}
(1 result)
So how did that work?
By using the pattern_replace char filter, we're stripping away everything but the raw numbers, meaning that "(213)234-1111" is actually stored as "2132341111" whenever we match a phone numbes. Since this pattern_replace is also applied at query time, we can now search both with and without the special characters in the phone number and get a match.
I'm new to ES and am struggling with nested aggregations.
Here is my dummy data object ([Here is my data object][1][1]: https://i.stack.imgur.com/X7oaM.png). I'm just trying to get the minimum cost out of the "modern" field.
I have read the following posts in regards to the problem I'm trying to solve. None of them have helped me solve the problem
- Elastic Search 6 Nested Query Aggregations
- https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-nested-aggregation.html
- https://madewithlove.be/elasticsearch-aggregations/
- https://iridakos.com/tutorials/2018/10/22/elasticsearch-bucket-aggregations.html
- https://github.com/elastic/elasticsearch/issues/9317
Moreover, I've searched all over stackoverflow and have had not had success (yes, I've tried just about every solution I've come across with no success).
According to the docs and the above posts and more, a nested aggregation should be ran as follows:
GET /loquesea/_search
{
"size": 0,
"aggs": {
"modern_costs": {
"nested": {
"path": "modern"
},
"aggs": {
"min_cost": {
"min": {
"field": "modern.cost1"
}
}
}
}
}
}
However, upon completion, this is what I get:
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 3,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"modern_costs" : {
"doc_count" : 0
}
}
}
I've spent hours trying to make just a basic nested aggregation work. What am I doing wrong?
problem is solved. Turns out that since I didn't declare in the mapping the type of "cars" as "nested", the nested aggregation will not work. Reason being is that in Elastic Search, since the type was not declared as "nested", ES will treat "cars" as an object.
I currently have a fairly simple document stored in ElasticSearch that I generated with an integration test:
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [ {
"_index" : "unit-test_project600",
"_type" : "recordDefinition505",
"_id" : "400",
"_score" : 1.0, "_source" : {
"field900": "test string",
"field901": "500",
"field902": "2050-01-01T00:00:00",
"field903": [
"Open"
]
}
} ]
}
}
I would like to filter for specifically field903 and a value of "Open", so I perform the following query:
{
query: {
filtered: {
filter: {
term: {
field903: "Open",
}
}
}
}
}
This returns no results. However, I can use this with other fields and it will return the record:
{
query: {
filtered: {
filter: {
term: {
field901: "500",
}
}
}
}
}
It would appear that I'm unable to search in arrays with ElasticSearch. I have read a few instances of people with a similar problem, but none of them appear to have solved it. Surely this isn't a limitation of ElasticSearch?
I thought that it might be a mapping problem. Here's my mapping:
{
"unit-test_project600" : {
"recordDefinition505" : {
"properties" : {
"field900" : {
"type" : "string"
},
"field901" : {
"type" : "string"
},
"field902" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"field903" : {
"type" : "string"
}
}
}
}
}
However, the ElasticSearch docs indicate that there is no difference between a string or an array mapping, so I don't think I need to make any changes here.
Try searching for "open" rather than "Open." By default, Elasticsearch uses a standard analyzer when indexing fields. The standard analyzer uses a lowercase filter, as described in the example here. From my experience, Elasticsearch does search arrays.