Date math in a query string is affected by analyzer

Elastic Stack Elasticsearch
1

It seems that a query_string with date math gets modified by the analyzer, and despite having read all the doc and searched everywhere, I can't find a way around it.

Here is a very basic example :

PUT twitter/_doc/1
{
    "user" : "kimchy",
    "post_date" : "2019-02-01T00:00:00",
    "message" : "trying out Elasticsearch"
}

Then

GET twitter/_search
{
   "query" : {
	    "query_string" : {
	       "analyzer" : "standard",
	       "query" : "post_date:[now-12M TO *]"
	    }   	
   }
}

Gives no results, my tests seems to indicate that the query is converted from "now-12M" (months) to "now-12m" (minutes).

Is there a way around it ?

Thanks

2

Which version are you using?

I don't know if this has ever worked...

The only way I found for now is to use:

GET twitter/_search
{
   "query" : {
	    "query_string" : {
	       "query" : "post_date:[now-12M TO *]"
	    }   	
   }
}
3

I'm using version 6.6.1 on CentOS7.

I really need the analyzer, so this is not really an option for me. The workaround that I have is to calculate the date in my app and concatenate it in the query, as the date string is not affected.

But I was wondering if this is a normal behavior.

4

Why do you need to define the analyzer?
Don't your text fields already define it?

5

The query string comes from a user exposed input field, and it's used for multi-field search.

I defined a custom analyzer for it to behave like I wanted :

    meta_search => {
      type => 'custom',
      tokenizer => 'whitespace',          
      filter => [qw/asciifolding lowercase elision/],          
      char_filter =>  [qw/strip_article/],
    },

Is there a better/other way to do this ?

6

Are you applying this analyzer to text fields in the mapping?

7

No I only apply this to the search query. I have defined some custom analyzers on my fields, but no search_analyzer.

8

Do that then and that should solve your problem IMO.

I'm not saying it's not a bug but this is at least a workaround.
Could you also try the simple_query_string query?

9

I'll try that and see what works best, and I'll post my findings if it can be of any interest for someone with a similar problem.

Thank you for your help.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.