Can't search for field from list of objects

Elastic Stack Elasticsearch
1

I have such data in Elastic:

{
  "_index": "portal-smm-provider",
  "_type": "portal-smm-provider",
  "_id": "5c38b3e552faff0008e50557",
  "_version": 1,
  "_score": 2,
  "_source": {
    "id": "5c38b3e552faff0008e50557",
    "rnk": null,
    "mfo": null,
    "edrpoy": "310262",
    "name": "Soame company",
    "divisionName": null,
    "status": null,
    "profileNumber": null,
    "profileDate": null,
    "archiveUrl": null,
    "services": [
      {
        "serviceCode": 18,
        "mfo": null,
        "accountNumber": null,
        "commission": null
      }
    ],
    "users": null,
    "version": 0
  }
}

here is a template for this:

{
  "index_patterns": "portal-smm-provider",
  "settings": { "number_of_shards": 5,
    "analysis": {
      "normalizer": {
        "useLowercase": {
          "type": "custom",
          "filter": [ "lowercase" ]
        }
      }
    
  } },
  "mappings": {
      "portal-smm-provider": {
        "properties": {
          "id": {"normalizer":"useLowercase", "type": "keyword"},
          "rnk": {"type": "integer", "copy_to": "full_provider"},
          "mfo": {"type": "integer", "copy_to": "full_provider"},
          "edrpoy": {"normalizer":"useLowercase", "type": "keyword", "copy_to": "full_provider"},
          "name": {"normalizer":"useLowercase", "type": "keyword", "copy_to": "full_provider"},
          "divisionName": {"normalizer":"useLowercase", "type": "keyword"},
          "status": {"type": "integer"},
          "profileNumber": {"normalizer":"useLowercase", "type": "keyword", "copy_to": "full_provider"},
          "profileDate": {"type": "date"},
          "archiveUrl": {"normalizer":"useLowercase", "type": "keyword"},
          "version": {"type": "long"},
          "serviceType": {
                    "properties": {
                      "serviceCode": {
                        "type": "integer", "copy_to": "full_provider"
                      },
                      "mfo": {
                        "type": "integer", "copy_to": "full_provider"
                      },
                      "accountNumber": {
                        "type": "integer", "copy_to": "full_provider"
                      },
                      "commission": { "normalizer":"useLowercase",
                        "type": "keyword"
                      }
                    }
                  },
                   "users": {
                     "properties": {
                       "phone": {"type": "keyword"
                      },
                        "hashPwd": {"type": "text"}
                     }
                   },
          "full_provider": {"type": "text"}
}
}
}
}

I try to search for field from a list and can't find anything:

POST portal-smm-provider/_search
{"query":
{
  "bool" : {
    "filter" : [
      {
        "match" : {
          "full_provider" : {
            "query" : "18",
            "operator" : "OR",
            "prefix_length" : 0,
            "max_expansions" : 50,
            "fuzzy_transpositions" : true,
            "lenient" : false,
            "zero_terms_query" : "NONE",
            "auto_generate_synonyms_phrase_query" : true,
            "boost" : 1.0
          }
        }
      }
    ],
    "adjust_pure_negative" : true,
    "boost" : 1.0
  }
}
}

If I try to find by any value from other fields (not in list) it will find document.
My opinion is that it's beacause of list of objects. In Kibana I have a message - "elastic objects in arrays are not well supported". Am I right? If yes, what I hava to do?

2

Your document does not match your mappings. In your template's mappings the serviceCode field is a field inside the serviceType object. However, in your document, that field is a field inside the services object.

There is no mapping for a services.serviceCode field, so Elasticsearch will apply a dynamic mapping when you index the document, and that field's value will not be copied to full_provider. As a result, your query for 18 returns no hits.

2 Likes
3

Thanks a lot.
May you write some example of adding to template list of objects? And I want then search by object fields inside of the list.
services is a list of objects serviceType

4

Solved by:

PUT _template/portal-smm-provider
 {
  "index_patterns": "portal-smm-provider",
  "settings": { "number_of_shards": 5,
    "analysis": {
      "normalizer": {
        "useLowercase": {
          "type": "custom",
          "filter": [ "lowercase" ]
        }
      }
      
  } },
  "mappings": {
      "portal-smm-provider": {
        "properties": {
          "id": {"normalizer":"useLowercase", "type": "keyword"},
          "rnk": {"type": "keyword", "copy_to": "full_provider"},
          "mfo": {"type": "keyword", "copy_to": "full_provider"},
          "edrpoy": {"normalizer":"useLowercase", "type": "keyword", "copy_to": "full_provider"},
          "name": {"normalizer":"useLowercase", "type": "keyword", "copy_to": "full_provider"},
          "divisionName": {"normalizer":"useLowercase", "type": "keyword"},
          "status": {"type": "integer"},
          "profileNumber": {"normalizer":"useLowercase", "type": "keyword", "copy_to": "full_provider"},
          "profileDate": {"type": "date"},
          "archiveUrl": {"normalizer":"useLowercase", "type": "keyword"},
          "version": {"type": "long"},
          "services": {
            "type": "nested",
                    "properties": {
                      "serviceCode": {
                        "type": "keyword", "copy_to": "full_provider"
                      },
                      "mfo": {
                        "type": "keyword", "copy_to": "full_provider"
                      },
                      "accountNumber": {
                        "type": "keyword", "copy_to": "full_provider"
                      },
                      "commission": { "normalizer":"useLowercase",
                        "type": "keyword"
                      }
                    }
                  },
                   "users": {
                     "type": "nested",
                     "properties": {
                       "phone": {"type": "keyword"
                      },
                        "hashPwd": {"type": "text"}
                     }
                   },
          "full_provider": {"type": "text"}
}
}
}
}
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.