Boolean Query

Elastic Stack Elasticsearch
1

I'm trying to query basically three AND's: "fields.name": "Date One" AND "fields.value": "2015-07-10" AND "filds.value_full": "Jhon Benny"

Here's what I tryed before:

{
   "query": {
      "filtered": {
         "query": {
            "match_all": {}
         },
         "filter": {
            "nested": {
               "path": "fields",
               "filter": {
                  "bool": {
                     "must": [
                        {
                           "term": {
                              "fields.name": "Date One"
                           }
                        },
                        {
                           "term": {
                              "fields.value": "2015-07-10"
                           }
                        }
                     ],
                     "should": [
                       {
                         "term": {
                           "fields.value_full": "John Benny"
                         }
                       },
                       {
                         "term": {
                           "fields.value": "Client"
                         }
                       }
                     ]
                  }
               }
            }
         }
      }
   }
}

And my JSON is this one here:

{
   "id": 1,
   "collection": "Document",
   "data_cad": "2015-07-10",
   "type_document": "Contract",
   "confidencial": "false",
   "fields": [
       {
           "name": "Date One",
           "value": "2015-07-10"
       },
       {
           "name": "Date Two",
           "value": "2017-07-10"
       },
       {
           "name": "Client",
           "value_full": "Jhon Benny"
       },
       {
           "name": "Value of Contract",
           "value_contract": 520.50
       }
   ]
}

If I just leave "fields.name": "Date One" AND "fields.value": "2015-07-10" it works fine, but as I wrote here, I get no results back.

2

The field.value_full is Jhon Benny in your document and John Benny in your query. This could be the reason?

If that doesn't fix it, could you paste your mappings for those fields here?

3

Unfortunately it didn't fix the problem.

The mapping:

{
   
      "mappings": {
         "my_type": {
            "properties": {
               "fields": {
                  "type": "nested",
                  
                  "properties": {
                     "name": {
                        "type": "string"
                     },
                     "value": {
                        "type": "date",
                        "format": "dateOptionalTime"
                     },
                     "value_contract": {
                        "type": "double"
                     },
                     "value_full": {
                        "type": "string"
                     }
                  }
               },
               "collection": {
                  "type": "string"
               },
               "confidencial": {
                  "type": "string"
               },
               "data_cad": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "id": {
                  "type": "long"
               },
               "type_document": {
                  "type": "string"
               }
            }
         }
      }
   
}
4

The reason you are getting no results is that your value_full field is analysed so John Benny will be split into two terms in the index john and benny. The term filter does not apply the analyzer to your search string so you are still searching for John Benny as a term in the index which does not exist. You have a few options here:

  1. Set "index": "not_analyzed" on the value_full field so you can do exact matching on it using the term filter. Note that you will not be able to do partial matching on value_full if you use this solution
  2. Use a filter/query that applies the analyzer to your search string. The match query will do this but you will either need to add it to the query section of your filtered_query or wrap it in a query filter.
  3. change your search terms to look for the actual terms rather than complete search string. This is the most brittle solution and the hardest to maintain since any changes to your analysis chain will affect the terms you need to search for.
5

Thank you for your helping! But I did what you said and put a "query" fillter before. However I got no results back.

{
   "query": {
      "filtered": {
         "query": {
            "match": {
              "fields.value_full": "Jhon"
            }
         },
         "filter": {
            "nested": {
               "path": "fields",
               "filter": {
                  "bool": {
                     "must": [
                        {
                           "term": {
                              "fields.name": "Date One"
                           }
                        },
                        {
                           "term": {
                              "fields.value": "2015-07-10"
                           }
                        }
                     ]
                  }
               }
            }
         }
      }
   }
}