Boolean Exact Query

Elastic Stack Elasticsearch
1

Hi,

I am currently not understanding why a specific query won't work. This is what is being sent to elasticsearch:

{
        "query": {
                "constant_score": {
                        "filter": {
                                "bool": {
                                        "must": [{
                                                        "term": {
                                                                "domain": "FOO"
                                                        }
                                                },
                                                {
                                                        "term": {
                                                                "value": "2002353708^^^&2.16.756.5.30.1.100.4.2&ISO~41433^^^&2.00.3.4.1.3&BAR"
                                                        }
                                                }
                                        ]
                                }
                        }
                }
        }
}

I am trying to exactly match all documents having both, the value "2002....BAR" as well as the domain value "FOO".
The requested document has a mapping where the fields "domain" and "value" are

...
          "domain" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
...
          "value" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },...

Any ideas? I'm sure I'm missing something obvious...

Thanks you!
Michael

2

Use the domain.keyword/value.keyword fields instead of domain/value.

3

Thanks Ivan! That should work (will test it later).

I wonder why this is the solution; is the value (without the keyword "qualification") analyzed by the default text analyzer and that's why not available to an exact query?

Best,
Michael

4

Correct. Using the default analyzer, the value for domain will be
lowercased to "foo". Term queries are using for exact matches, so they
should be used on non-strings, non-analyzed strings (keyword), or strings
with a keyword tokenizer.

GET /_analyze
{
"text" :
"2002353708^^^&2.16.756.5.30.1.100.4.2&ISO~41433^^^&2.00.3.4.1.3&BAR"
}

{
"tokens": [
{
"token": "2002353708",
"start_offset": 0,
"end_offset": 10,
"type": "",
"position": 0
},
{
"token": "2.16.756.5.30.1.100.4.2",
"start_offset": 14,
"end_offset": 37,
"type": "",
"position": 1
},
{
"token": "iso",
"start_offset": 38,
"end_offset": 41,
"type": "",
"position": 2
},
{
"token": "41433",
"start_offset": 42,
"end_offset": 47,
"type": "",
"position": 3
},
{
"token": "2.00.3.4.1.3",
"start_offset": 51,
"end_offset": 63,
"type": "",
"position": 4
},
{
"token": "bar",
"start_offset": 64,
"end_offset": 67,
"type": "",
"position": 5
}
]
}

5

Thanks a lot Ivan, this helps :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.