Adding sort to ES query returns inaccurate results?

Elastic Stack Elasticsearch
1

My queries are successfully returning the exact results that I am looking for.

{
   "size":100,
   "from":0,
   "query":{
      "bool":{
         "must":[
            {
               "bool":{
                  "should":[
                     {
                        "match":{
                           "ProcessId":"from-cn"
                        }
                     }
                  ]
               }
            }
         ]
      }
   }

This returns only items with ProcessId "from-cn"
However, when I add a sort query like this:

{
   "size":100,
   "from":0,
   "sort":[
      {
         "CreatedTimeStamp":{
            "order":"desc"
         }
      }
   ],
   "query":{
      "bool":{
         "must":[
            {
               "bool":{
                  "should":[
                     {
                        "match":{
                           "ProcessId":"from-cn"
                        }
                     }
                  ]
               }
            }
         ]
      }
   }
}

This is now returning all "from-cn", but it is also returning several other results that do NOT have ProcessId "from-cn".

I know it is the sort that is causing the issue because when I remove sort, it returns perfectly.

Why is this happening here? How can I fix?

EDIT: I'm now thinking it's possible that my ES is returning matches, but not EXACT matches. Is there a way to ensure that ES only returns exact, verbatim matches?

2

It depends on the mapping for the field ProcessId.
What is it?

3

What does that mean exactly? I believe it is just default mapping. I don't remember changing it, but is there a way to check ?

5

I believe it is just default mapping.

So try with ProcessId.keyword instead.

6

This worked. Thank you :slight_smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.