Complex regexp

[sphawk]

hello everybody,
i'm new in elasticsearch and i'm creating an internal search engine for my company.
i'm try to make a query that must returns only files contained in some paths.
here is my PHP code:

$params['body']['query']['bool']['should']['regexp']['file'] = "/(000_Public|010_Users|020_Private)/";

the query should match any file where path is "foo/000_Public/foo" or "foo/010_Users/foo" etc.
i've tried multiple format
"/(000_Public|010_Users|020_Private)/"
".(000_Public|010_Users|020_Private)."
"000_Public"
".000_Public."

every query return 0 hits
the full request is:

{
    "from": 0,
    "size": 10,
    "type": "_doc",
    "body": {
        "sort": {
            "date": "asc"
        },
        "query": {
            "bool": {
                "should": {
                    "regexp": {
                        "file": ".*(000_Public|010_Users|020_Private).*"
                    }
                }
            }
        }
    },
    "index": "allfiles"
}

help!

[Christian_Dahlqvist]

What is the mapping of the file field?

[sphawk]

file is the filed with the path and the filename

'file': '/home/samba/000_Public/file.doc'

and sorry, i don't know what is a mapping and how to see what is the mapping for this field.

[Christian_Dahlqvist]

What is the mapping in Elasticsearch for this field? Use the get mapping API to find out.

If you have not specified mappings it is likely that you are using dynamic mappings, and in that case file is mapped as an analyzed text field on which regexp will not work. Instead try using file.keyword and see if that helps.

[sphawk]

{
    "aperiodici": {
        "mappings": {
            "_doc": {
                "file": {
                    "full_name": "file",
                    "mapping": {
                        "file": {
                            "type": "text",
                            "fields": {
                                "keyword": {
                                    "type": "keyword",
                                    "ignore_above": 256
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

(i like your avatar so much!)

[Mark_Harwood]

As well as using ‘file.keyword’ as the field name in your query try use ‘.*’ at the beginning and end of the regex string if you’re only supplying part of the file name in the search

[sphawk]

awesome!
thank both of you.