ElasticSearch returning all documents - elasticsearch

Here is the query I am sending to ElasticSearch:
http://localhost:9200/user-index/user/_search/?queryb%5Bname%5D=Richard
The returned JSON is this:
{
"hits": [
{
"_index": "user-index",
"_type": "user",
"_id": "WgrvE-DzQJminNreBIsRNA",
"_score": 1.0,
"_source": {
"name": "Richard",
"db_id": "7"
}
},
{
"_index": "user-index",
"_type": "user",
"_id": "GwMOuYbUR8y48RrG4HgXdg",
"_score": 1.0,
"_source": {
"name": "John",
"db_id": "8"
}
},
{
"_index": "user-index",
"_type": "user",
"_id": "C-bgK3pNTNiX9Cz0x8EftA",
"_score": 1.0,
"_source": {
"name": "Harold",
"db_id": "2"
}
}
]
}
Only one of those actually matches. Why is it sending them all back?


Elasticsearch returns all records with the type user in the index user-index because it cannot find the search query. The search query should be specified as a query string in the parameter "q" or as a request body.
Try http://localhost:9200/user-index/user/_search?q=name%3ARichard

Related

Elastic Search Key value update

my index key is stored as text but it is a nested json how can I update its values
Current Value of the key
{
"_index": "public_test",
"_type": "_doc",
"_id": "ec476fd0-c038-431a-be9a-4455cded91f8",
"_score": 1.0,
"_source": {
"user_id": "xxxxxxxxxx",
"lang_subscription": """[{"lang": "English", "is_subscribed": 1}]"""
}
}
But the value I want is
{
"_index": "public_test",
"_type": "_doc",
"_id": "ec476fd0-c038-431a-be9a-4455cded91f8",
"_score": 1.0,
"_source": {
"user_id": "xxxxxxxxxx",
"lang_subscription": [{ "lang": "English", "is_subscribed": 1 }]
}
}

Elasticsearch: Not giving match

I want to perform both exact word match and partial word/sub string match. For example, if I search for "test product" then I should be able to find "test" and "product" related text in the result. I'm searching Elasticsearch with the below match query, which is not giving me the exact match, instead its giving some more irrelevant match.
I'm using Elasticsearch 6.3
My query for GET /_search:
{
"must": {
"query_string": {
"query": "title:*test product*"
}
}
}
Search Result:
"hits": [
{
"_index": "67107104",
"_type": "_doc",
"_id": "1",
"_score": 0.6931471,
"_source": {
"title": "testing"
}
},
{
"_index": "67107104",
"_type": "_doc",
"_id": "2",
"_score": 0.6931471,
"_source": {
"title": "product good"
}
},
{
"_index": "67107104",
"_type": "_doc",
"_id": "3",
"_score": 0.6931471,
"_source": {
"title": "sample"
}
}
]
Expected Search Result:
"hits": [
{
"_index": "67107104",
"_type": "_doc",
"_id": "1",
"_score": 0.6931471,
"_source": {
"title": "testing"
}
},
{
"_index": "67107104",
"_type": "_doc",
"_id": "2",
"_score": 0.6931471,
"_source": {
"title": "product good"
}
}
]

In the search query above, you are searching in the review field, whereas in the search result you are getting data for title field
Adding a working example with index data, search query, and search result
Index Data:
{
"review": "testing"
}
{
"review": "product good"
}
{
"review": "sample"
}
Search Query:
{
"query": {
"match": {
"review": "test product"
}
}
}
Search Result:
"hits": [
{
"_index": "67119314",
"_type": "_doc",
"_id": "2",
"_score": 0.2876821,
"_source": {
"review": "product good"
}
}
]

Unable to achieve aggregation using date range

I have JSON Data
"hits": [
{
"_index": "Index",
"_type": "_doc",
"_id": "",
"_score": 1,
"_source": {
"supportdate": "20180631T000000Z",
}
},
{
"_index": "Index",
"_type": "_doc",
"_id": "",
"_score": 1,
"_source": {
"supportdate": "20190622T000000Z",
}
},
{
"_index": "Index",
"_type": "_doc",
"_id": "",
"_score": 1,
"_source": {
"supportdate": "20181231T000000Z",
}
}
]
Am trying to write aggregation query which will find records in particular "supportdate" range and categorise records as "Active and Expiring" buckets. Support date field has ISO date format(YYYYMMDDThhmmssZ).
As I have tried different date range queries, but no luck. As am new to elastic search database, bit struggling.
Appreciate any help!!

"match" query along with "should" clause giving more than required match results in Elasticsearch

I have written the following lucene query in elasticsearch for getting documents with Id field as mentioned:
GET requirements_v3/_search
{
"from": 0,
"size": 10,
"query": {
"bool": {
"filter": {
"bool": {
"should": [
{"match": {
"Id": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b"
}},
{
"match": {
"Id": "048b7907-2b5a-438a-ace9-f1e1fd67ca69"
}
},
{
"match": {
"Id": "3b385896-1207-4f6d-8ae9-f3ced84cf1fa"
}
},
{
"match": {
"Id": "0aa1db52-c0fb-4bf6-9223-00edccc32703"
}
},
{
"match": {
"Id": "8c399993-f273-4ee0-a1ab-3a85c6848113"
}
},
{
"match": {
"Id": "4461eb37-487e-4899-a7be-914640fab0e0"
}
},
{
"match": {
"Id": "07052261-b904-4bfc-a6fd-3acd28114c6a"
}
},
{
"match": {
"Id": "95816ff0-9eae-4196-99fc-86c6f43395fd"
}
},
{
"match": {
"Id": "ea8a59a6-2b2f-467a-9beb-e281b1581a0a"
}
},
{
"match": {
"Id": "33f87d98-024f-4893-aa1c-8d438a98cd1f"
}
}
]
}
}
}
}
The response for the above query is:
{
"took": 14,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 18,
"max_score": 0,
"hits": [
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "9d8060da-c3e2-4f6d-b4e2-17e65b266c76",
"_score": 0,
"_source": {
"Id": "9d8060da-c3e2-4f6d-b4e2-17e65b266c76",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "4461eb37-487e-4899-a7be-914640fab0e0",
"_score": 0,
"_source": {
"Id": "4461eb37-487e-4899-a7be-914640fab0e0",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "33f87d98-024f-4893-aa1c-8d438a98cd1f",
"_score": 0,
"_source": {
"Id": "33f87d98-024f-4893-aa1c-8d438a98cd1f",
"Name": "Create Configurator"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "d75d9a7c-e145-487e-922f-102c16d0026f",
"_score": 0,
"_source": {
"Id": "d75d9a7c-e145-487e-922f-102c16d0026f",
"Name": "Create Configurator"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "007eadb7-adda-487e-b7fe-6f6b5648de2e",
"_score": 0,
"_source": {
"Id": "007eadb7-adda-487e-b7fe-6f6b5648de2e",
"Name": "Detail Page - Build"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "95816ff0-9eae-4196-99fc-86c6f43395fd",
"_score": 0,
"_source": {
"Id": "95816ff0-9eae-4196-99fc-86c6f43395fd",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "07052261-b904-4bfc-a6fd-3acd28114c6a",
"_score": 0,
"_source": {
"Id": "07052261-b904-4bfc-a6fd-3acd28114c6a",
"Name": "HUC"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "d60daf3a-4681-4bfc-a3a9-b04b5b005f73",
"_score": 0,
"_source": {
"Id": "d60daf3a-4681-4bfc-a3a9-b04b5b005f73",
"Name": "DAMS UpsertUnenrollPrice" }
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "c1b367f2-a57a-487e-994c-84470e0f9db4",
"_score": 0,
"_source": {
"Id": "c1b367f2-a57a-487e-994c-84470e0f9db4",
"Name": "Item Setup"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b",
"_score": 0,
"_source": {
"Id": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b",
"Name": "Installments"
}
}
]
}
}
This mentions totalHits as '18'. Why is it returning more items than 10? I believe match query should be used for 'exact' matches, so why more documents are returned here?
P.S.: I know I can use the Ids query for this, but I want to know why is this not returning the correct response
Update: Setting the size to 20 returns the following response:
{
"took": 195,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 18,
"max_score": 0,
"hits": [
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "9d8060da-c3e2-4f6d-b4e2-17e65b266c76",
"_score": 0,
"_source": {
"Id": "9d8060da-c3e2-4f6d-b4e2-17e65b266c76",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "4461eb37-487e-4899-a7be-914640fab0e0",
"_score": 0,
"_source": {
"Id": "4461eb37-487e-4899-a7be-914640fab0e0",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "33f87d98-024f-4893-aa1c-8d438a98cd1f",
"_score": 0,
"_source": {
"Id": "33f87d98-024f-4893-aa1c-8d438a98cd1f",
"Name": "Create Configurator"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "d75d9a7c-e145-487e-922f-102c16d0026f",
"_score": 0,
"_source": {
"Id": "d75d9a7c-e145-487e-922f-102c16d0026f",
"Name": "Create Configurator"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "007eadb7-adda-487e-b7fe-6f6b5648de2e",
"_score": 0,
"_source": {
"Id": "007eadb7-adda-487e-b7fe-6f6b5648de2e",
"Name": "Detail Page - Build"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "95816ff0-9eae-4196-99fc-86c6f43395fd",
"_score": 0,
"_source": {
"Id": "95816ff0-9eae-4196-99fc-86c6f43395fd",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "07052261-b904-4bfc-a6fd-3acd28114c6a",
"_score": 0,
"_source": {
"Id": "07052261-b904-4bfc-a6fd-3acd28114c6a",
"Name": "HUC"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "d60daf3a-4681-4bfc-a3a9-b04b5b005f73",
"_score": 0,
"_source": {
"Id": "d60daf3a-4681-4bfc-a3a9-b04b5b005f73",
"Name": "DAMS UpsertUnenrollPrice"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "c1b367f2-a57a-487e-994c-84470e0f9db4",
"_score": 0,
"_source": {
"Id": "c1b367f2-a57a-487e-994c-84470e0f9db4",
"Name": "Item Setup"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b",
"_score": 0,
"_source": {
"Id": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b",
"Name": "Installments"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "b9437079-47c4-487e-abf0-1ff076f69e0f",
"_score": 0,
"_source": {
"Id": "b9437079-47c4-487e-abf0-1ff076f69e0f",
"Name": "Detail Page - Strings "
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "0aa1db52-c0fb-4bf6-9223-00edccc32703",
"_score": 0,
"_source": {
"Id": "0aa1db52-c0fb-4bf6-9223-00edccc32703",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "ea8a59a6-2b2f-467a-9beb-e281b1581a0a",
"_score": 0,
"_source": {
"Id": "ea8a59a6-2b2f-467a-9beb-e281b1581a0a",
"Name": "Create Configurator"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "fd259359-4f6d-4530-ac29-fcebe00d66a6",
"_score": 0,
"_source": {
"Id": "fd259359-4f6d-4530-ac29-fcebe00d66a6",
"Name": "Invite Platform"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "1b2ba0bb-3e7f-46fb-b904-07460b84848b",
"_score": 0,
"_source": {
"Id": "1b2ba0bb-3e7f-46fb-b904-07460b84848b",
"Name": "Training"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "8c399993-f273-4ee0-a1ab-3a85c6848113",
"_score": 0,
"_source": {
"Id": "8c399993-f273-4ee0-a1ab-3a85c6848113",
"Name": "Configure ASIN for Reporting"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "3b385896-1207-4f6d-8ae9-f3ced84cf1fa",
"_score": 0,
"_source": {
"Id": "3b385896-1207-4f6d-8ae9-f3ced84cf1fa",
"Name": "Create Extended/Limited Warranty Configuration"
}
},
{
"_index": "requirements_v3",
"_type": "_doc",
"_id": "048b7907-2b5a-438a-ace9-f1e1fd67ca69",
"_score": 0,
"_source": {
"Id": "048b7907-2b5a-438a-ace9-f1e1fd67ca69",
"Name": "Invite Platform"
}
}
]
}
}

Lets understand this by the following mapping e.g:
{
"_doc": {
"properties": {
"Id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
The above mapping is created dynamically by elasticsearch. Lets us now focus on Id field. Its type is text. By default the analyzer for text datatype is standard analyzer. When this analyzer is applied on the input for this field it get tokenized into terms. So for example if you input value for Id is 33f87d98-024f-4893-aa1c-8d438a98cd1f following tokens get generated:
33f87d98
024f
4893
aa1c
8d438a98cd1f
As you can see the input value is splitted by - being used as delimiter. This is because standard analyzer is applied on it.
There is another sub-field under Id which is keyword and its type is keyword. For type keyword the input is indexed as it is without applying any modification.
Now lets understand why more documents get matched and result count is more than expected. In your query you used match query on Id field as below:
{
"match": {
"Id": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b"
}
}
By default match query uses the same analyzer that is applied on the field in mapping. So on the Id value in the query again the same analyzer is applied and the input is splitted into tokens in a similar way as above. The default operator that is applied between tokens of match query input string is OR and hence your query actually becomes:
b8bf49a4 OR 960b OR 4fa8 OR 8c5f OR a3fce4b4d07b
There if any of the above tokens match to any of the indexed terms stored in Id field, the document is considered a match.
Solution for the above based on above mapping:
Use the keyword field instead. So the query becomes:
{
"match": {
"Id.keyword": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b"
}
}
More on how match works see here.
Also as mention by #Curious_MInd in his answer its better to use terms than using multiple match in should.

As you said that your Id is text as well as keyword so you should use Id.keyword for matching exact values like
GET requirements_v3/_search
{
"from": 0,
"size": 10,
"query": {
"bool": {
"filter": {
"bool": {
"should": [
{"match": {
"Id.keyword": "b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b"
}},
{
"match": {
"Id.keyword": "048b7907-2b5a-438a-ace9-f1e1fd67ca69"
}
}
]
}
}
}
}
But I guess you should use terms if you wants to match multiple exact values. Have a look here. For an example:
{
"terms" : {
"Id" : ["b8bf49a4-960b-4fa8-8c5f-a3fce4b4d07b", "048b7907-2b5a-438a-ace9-f1e1fd67ca69"]
}
}

elastic search 5.1 why stored_fields does not return asked field?

In Elastic Search 5.1 I am making basic request with stored_fields body argument (new name for old fields argument) for retrieving the value of a specific field.
But my request give no field value in answer except _index, _type, _id and _score
I Give you sample for context:
I create index and mapping with:
PUT /base_well
{
"mappings": {
"person": {
"properties": {
"first_name":{
"type": "string"
},
"last_name":{
"type": "string"
},
"age":{
"type": "long"
}
}
}
}
}
I populate :
POST /base_well/person
{
"first_name":"James",
"last_name" : "Mopo",
"Age" : 21
}
POST /base_well/person
{
"first_name":"Polo",
"last_name" : "Rodriguez",
"Age" : 36
}
POST /base_well/person
{
"first_name":"Marc Aurelien",
"last_name" : "Poisson",
"Age" : 26
}
POST /base_well/person
{
"first_name":"Mustapha",
"last_name" : "Bulutu M'Bo",
"Age" : 47
}
I do my request with:
POST /base_well/person/_search
{
"stored_fields": ["first_name"]
}
And it give me an answere without the requested field fiest_person:
{
"took": 4,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 8,
"max_score": 1,
"hits": [
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFYzihcR_Z5VPUXUCL",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFiv3acR_Z5VPUXUCa",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFiwUKcR_Z5VPUXUCb",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFYx2LcR_Z5VPUXUCI",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFYyhScR_Z5VPUXUCJ",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFYzIJcR_Z5VPUXUCK",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFivgzcR_Z5VPUXUCZ",
"_score": 1
},
{
"_index": "base_well",
"_type": "person",
"_id": "AVlFiw2qcR_Z5VPUXUCc",
"_score": 1
}
]
}
}
Anybody could explain me to do it and how it works please?

By default, the document fields are not stored, i.e. in your mapping you don't specify store: true for each of them.
Hence, "stored_fields": ["first_name"] will not be able to return the first_name field since it's not stored.
You can use source filtering instead and specify "_source": ["first_name"] in your query, that will work.

Resources