Default_operator=or on query string not honored within paren grouping?

Elastic Stack Elasticsearch
1

Per the ES docs

where the title field contains quick or brown. If you omit the OR operator the default operator will be used

title:(quick OR brown)
title:(quick brown)

If I do
{
"query_string":{
"query":"guid:(string1 OR string2)",
"default_operator":"or"
}
}
I get 2 results (expected behavior, as there are 2 objects one each with the supplied value for that field). If I remove the 'or'
{
"query_string":{
"query":"guid:(string1 string2)",
"default_operator":"or"
}
}
I get 0 results. It does not appear to honor the default_operator as described in the docs? This used to work with ES 2.x but on updating to ES 6.3, no dice.

Interestingly, if I add one of the values in quotes, it works
"query":"guid:(string1 \"string2\")",

Any ideas what I'm missing or what parameter will make this work as documented?
Thanks!

2

The guid field is probably mapped as type keyword?

The docs (Query string query | Elasticsearch Guide [8.11] | Elastic) have a warning that explains the behavior you're seeing:

Whitespaces are not considered operators, this means that new york city will be passed "as is" to the analyzer configured for the field. If the field is a keyword field the analyzer will create a single term new york city and the query builder will use this term in the query. If you want to query each term separately you need to add explicit operators around the terms (e.g. new AND york AND city).

1 Like
3

Thanks! Makes sense.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.