A really stupid newbie question - term versus query \query string

Elastic Stack Elasticsearch
1

Hello,

First post and I cannot seem to find the answer by searching the forum or
internet. We are very new to elasticsearch, and I am integrating it into
our app.

I build an index based on what I thought was a simple example document with
some single value fields and an array of "Fields", which is a structure
containing a string "FieldName" amongst other things.

When I use a simple rest tester and post the following query, I get the
expected results of all documents having a field named "ContentBody"
(please note that this query is going to evolve into more and logic):
{
"size": "20",
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"and": [
{"query" : {"query_string" : {"fields" :
["Fields.FieldName"], "query" : "ContentBody"}}}
]
}
}
}
}

However, this query does not return any results:

{
"size": "20",
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"and": [
{"term" : {"Fields.FieldName": "ContentBody"}},
]
}
}
}
}

This is all off default mapping. I am sure I am missing something brain
dead simple about the way the term query works, and any insights are
appreciated.

Thank you

--

2

Query string queries are analyzed, while term queries are not. Analyzing
means tokenizing a field and applying various filters (lowercase, ascii
folding, etc...).

If you are using the default mapping, then Fields.FieldName was analyzed,
which means it was lowercased. The query string query also analyzed your
query string, so there was a match. A term query is not analyzed, so your
query was not lowercased, and therefore did not match your indexed term
(which was lowercased).

You can see the different by using the analysis API:

http://localhost:9200/_analyze?text=ContentBody&analyzer=standard (analyzed)
http://localhost:9200/_analyze?text=ContentBody&analyzer=keyword (not
analyzed)

Analysis in Elasticsearch is purely based on concepts from Lucene. You can
learn more about analysis by reading Lucene documentation (although the
Elasticsearch documentation is probably better in most cases).

Cheers,

Ivan

On Sun, Oct 28, 2012 at 9:13 AM, Rjoys rjoys@snapflow.com wrote:

Hello,

First post and I cannot seem to find the answer by searching the forum or
internet. We are very new to elasticsearch, and I am integrating it into
our app.

I build an index based on what I thought was a simple example document
with some single value fields and an array of "Fields", which is a
structure containing a string "FieldName" amongst other things.

When I use a simple rest tester and post the following query, I get the
expected results of all documents having a field named "ContentBody"
(please note that this query is going to evolve into more and logic):
{
"size": "20",
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"and": [
{"query" : {"query_string" : {"fields" :
["Fields.FieldName"], "query" : "ContentBody"}}}
]
}
}
}
}

However, this query does not return any results:

{
"size": "20",
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"and": [
{"term" : {"Fields.FieldName": "ContentBody"}},
]
}
}
}
}

This is all off default mapping. I am sure I am missing something brain
dead simple about the way the term query works, and any insights are
appreciated.

Thank you

--

--

3

Thank you Ivan. The query now works, and I appreciate the guidance as to
where to dig in for more info!

Cheers

On Sunday, October 28, 2012 9:13:40 AM UTC-7, Rjoys wrote:

Hello,

First post and I cannot seem to find the answer by searching the forum or
internet. We are very new to elasticsearch, and I am integrating it into
our app.

I build an index based on what I thought was a simple example document
with some single value fields and an array of "Fields", which is a
structure containing a string "FieldName" amongst other things.

When I use a simple rest tester and post the following query, I get the
expected results of all documents having a field named "ContentBody"
(please note that this query is going to evolve into more and logic):
{
"size": "20",
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"and": [
{"query" : {"query_string" : {"fields" :
["Fields.FieldName"], "query" : "ContentBody"}}}
]
}
}
}
}

However, this query does not return any results:

{
"size": "20",
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"and": [
{"term" : {"Fields.FieldName": "ContentBody"}},
]
}
}
}
}

This is all off default mapping. I am sure I am missing something brain
dead simple about the way the term query works, and any insights are
appreciated.

Thank you

--