Elastic Search Query to fetch data control or special characters

Elastic Stack Elasticsearch
1

Trying to search for severity values with special characters in it e.g. "1 - Critical". tried with backslashes to see if I can get the exact results.
If I change the query below with "*2 \\- Cri*", it also returns documents with values '1 - Critical' and '2 - Major'. I tried by putting .keyword but no results. Pls. assist.

POST /_search
{

"from" : 0, "size" : 1000,
"query":
{
"bool": {
"must": [
{"query_string": {"fields": ["severity"],
"query": "*1 \\- Cr*"}
}
]
}
},
"_source" : ["ticketNo","severity"]
}

2

Please add sample doc and mapping.

3

Mapping :

{
"test" : {
"aliases" : { },
"mappings" : {
"properties" : {
"severity" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ticketNo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}

Sample docs :
POST test/_doc/1
{
"severity" : "1 - Critical",
"ticketNo" : "1"
}

POST test/_doc/2
{
"severity" : "2 - Major",
"ticketNo" : "2"
}

4

When you want to use wildcard in query string then use the keyword type of field. Here, severity.keyword. Also you need to escape only those special character which are part of lucene query syntax. The query would be:

POST /_search
{
  "from": 0,
  "size": 1000,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "fields": [
              "severity"
            ],
            "query": "*1 - Cri*"
          }
        }
      ]
    }
  },
  "_source": [
    "ticketNo",
    "severity"
  ]
}

NOTE:

  1. Wildcard queries are heavy. Use * with care.
  2. Querying on keyword type of field will be case-sensitive.
5

Thanks Nishant, what is the option if I want to enable case-insensitive search with wild card

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.