I am trying to implement NOT condition in elasticsearch query.
Can I Implement filter inside bool or I need to write separate
filter as below. Any optimum solution is there?
{
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "fashion"
}
},
{
"term": {
"post_status": "publish"
}
}
]
}
},
"filter": {
"not": {
"filter": {
"term": {
"post_type": "page"
}
}
}
}
}
You can use a must_not clause:
{
"query": {
"bool": {
"must": [
{
"match": {
"_all": "fashion"
}
},
{
"term": {
"post_status": "publish"
}
}
],
"must_not": {
"term": {
"post_type": "page"
}
}
}
}
}
Also, I'd recommend using a match filter instead of query_string, as query_string requires the much more strict Lucene syntax (and is therefor more error prone), whereas match works more like a search box: it will automatically transform a human readable query to a Lucene query.
Related
I have data in the following format:
{ "_id":1,
"s_id":121211,
"data_detail":{
"name":"John",
"phone_number":08089320xxx,
"city":"ABC"
}
}
I need to search data through elastic search which will query where s_id=? and any text which is available in data_detail object. Example s_id=121211 AND ABC. I need wildcard on data_detail object.
Keys for the data_detail object is not fixed.
Thanks in advance.
I would consider using a bool query with multi_match and term query like this. I haven't tested this, but something on these lines should work I guess.
GET test_index/_search
{
"query": {
"nested": {
"path": "data_detail",
"query": {
"bool": {
"must": [
{
"multi_match": {
"query": "ABC",
"fields": [
"data_detail.*"
]
}
},
{
"term": {
"s_id": {
"value": "121211"
}
}
}
]
}
}
}
}
}
Solved this by using the following query:
{
"query": {
"bool": {
"must": [
{
"query_string":{
"fields":["data_detail.*"],
"query": "*str*",
"analyze_wildcard":true
}
},
{
"term": {
"s_id": {
"value": "121211"
}
}
}
]
}
}
}
I'm trying to have multiple wildcard query match in my elasticsearch query in Kibana. I can't quite figure it out.
Basically I want any document with an attribute type="erreur"
and I want to exclude all documents that match the strings "An established*" or "java.lang.*" on the field descr_courte
{
"query": {
"bool": {
"must": {
"term": {
"type": "erreur"
}
},
"must_not": {
"wildcard": {
"descr_courte": ["An established*", "java.lang.*"]
}
}
}
}
}
if I put a single wildcard query it works fine
{
"query": {
"bool": {
"must": {
"term": {
"type": "erreur"
}
},
"must_not": {
"wildcard": {
"descr_courte":
"An established*"
}
}
}
}
}
the error I get:
Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_state_exception","reason":"Can't get text on a START_ARRAY at 1:454"}],"type":"search_phase_execution_exception","reason":"all shards
Any idea?
Try putting them is separate clauses.
{
"query": {
"bool": {
"must": {
"term": {
"type": "erreur"
},
"must_not": [
{
"wildcard": {
"descr_courte": "An established*"
}
},
{
"wildcard": {
"descr_courte": "java.lang.*"
}
}
]
}
}
}
}
My guess is that you can't make an array for wildcard query like ["An established*", "java.lang.*"], so you need to:
{
"query": {
"{
"must": {
"term": {
"type": "erreur"
}
},
"must_not": {
"regexp": {
"descr_courte": "(An established|java\.lang\.).*"
}
}
}
}
}
More info about regexp query in https://www.elastic.co/guide/en/elasticsearch/reference/5.1/query-dsl-regexp-query.html
Another option is to combine your query terms with the logical operators NOT, AND and OR in the query string
{
"query": {
"query_string" : {
"query" : "type:erreur AND NOT(descr_courte:An established* OR descr_courte:java.lang.*)"
}
}
}
See more info at https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_wildcards
I have a query String like this:
"(( name_first.raw:goda )) AND !( _uid:*566ade1cec8d83647a000061* OR _uid:*566ade1cec8d83647a000062* OR _uid:*566ade1cec8d83647a000063* OR _uid:*566ade1cec8d83647a000064*)"
How can I write this query in a more efficient way?
You can use the query below:
POST <index>/<type>/_search
{
"query": {
"filtered": {
"query": {
"term": {
"name_first.raw": "goda"
}
},
"filter": {
"bool": {
"must_not": [
{
"terms": {
"_uid": [
"566ade1cec8d83647a000061",
"566ade1cec8d83647a000062",
"566ade1cec8d83647a000063"
]
}
}
]
}
}
}
}
}
I think this would work,
GET /yourindex/yourType/_search
{
"query": {
"filtered": {
"query": {
"match": {
"name_first.raw": "goda"
}
},
"filter": {
"bool": {
"must_not": [
{
"terms": {
"_uid": [
"566ade1cec8d83647a000061",
"566ade1cec8d83647a000062",
"566ade1cec8d83647a000063"
]
}
}
]
}
}
}
}
}
This should work, (+ => "must" and - => "must_not")
"+name_first.raw:goda -_uid:*566ade1cec8d83647a000061* -_uid:*566ade1cec8d83647a000062* -_uid:*566ade1cec8d83647a000063* -_uid:*566ade1cec8d83647a000064*"
What worries me is that the processing of the leading wildcards could really slow this down. Do you absolutely need wildcards? If you find yourself needing to optimize this, and can start using the DSL, check out post_filter for your exclusion criteria.
I'm trying to add a complex filter on a wildcard query with elastic search. The filter seems to be working, however, the results don't talk into account the wildcard. Is this possible or is there an alternative to the wildcard filter? Query is as follows:
{
"query": {
"filtered": {
"query": {
"wildcard": {
"name": "*frog*"
},
"filter": {
"bool": {
"must": {
"term": {
"is_animal": false
}
}
},
"or": [
{
"terms": {
"reptiles.codes": [
27
]
}
},
{
"nested": {
"path": "owners",
"query": {
"bool": {
"should": {
"term": {
"pets": "cat"
}
}
}
}
}
},
{
"nested": {
"path": "locations",
"query": {
"bool": {
"should": {
"term": {
"home": true
}
}
}
}
}
}
]
}
}
}
}
}
Alternatively, can I add the wildcard as a filter inside my "bool": { "must": .... }} ?
You should definitely use ngram token filter in your analyzer instead of running a wildcard which is really slow, especially if it starts with a star which is the case here.
That being said, I don't understand why the wildcard part is not applied here. Any chance you could reproduce your case with a full example? May be you have specific analyzer?
Is it possible to combine query_string and bool query in filter query?
For Example -
{
"filter": {
"query_string": {
"query": "field:text"
}
},
"bool": {
"should": {
"match": {
"field": "text"
}
}
}
}
bool is meant to be used to club various queries together into a single bool query.
You can use bool to combine multiple queries in this manner -
{
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "field:text"
}
},
{
"match": {
"field": "text"
}
}
]
}
}
}
The must clause will make sure all the conditions are matched.
You can also use should which will make sure either one of the query is matched in case of only should is used.
As bool is just another query type , you can also club bool queries inside bool queries as follows -
{
"query": {
"bool": {
"must": [
{
"bool": {
"must": [
{
"query_string": {
"query": "field:text"
}
},
{
"match": {
"field": "value"
}
}
]
}
},
{
"match": {
"field": "text"
}
}
]
}
}
}