ElasticSearch-6.8 - querying with hyphens in fields does not get results

[spp125 (Mike)]

I have a users index in that there is a field called groupName that have value like "ad-users" when I query to match how many users belong to "ad-users" groupName. Upon querying to match on groupName I got no results. Here is my query

{
  "bool": {
    "must": [
      {
        "query_string": {
          "query": "*",
          "default_operator": "OR"
        }
      },
      {
        "term": {
          "isServiceAccount": false
        }
      },
      {
        "match": {
          "memberOf.groupName": "ad-users"
        }
      }
    ]
  }
}

Please guide me on what I am doing wrong?

[warkolm (Mark Walkom)]

Welcome to our community!

How is that field mapped?
Also please be aware that 6.8 is EOL and you should be looking to upgrade ASAP.

[spp125 (Mike)]

Thank you for your warm welcome.
Upgrading to latest version is in pipeline.

groupName field mapping is like this

 "groupName": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256.0
                }
              }
            },

Thank you

[Christian_Dahlqvist]

@spp125

there is a field called group that have value like "ad-user"

@spp125

"memberOf.groupName": "ad-users"

Seems a bit inconsistent (ad-user vs ad-users). Can you show a sample document you expect to match?

[spp125 (Mike)]

Hi Chris,

I have edited the post to be consistent. Sorry for any confusion.

{
    "_source": {
        "firstName": "Mike",
        "lastName": "Bankert",
        "name": "Mike Bankert",
        "memberOf": [
            {
                "groupName": "ad-users"
            }
        ]
    }
}

Above is one of document, but I have more users in my index.

[Christian_Dahlqvist]

That document does not have the isServiceAccout field, so should not match the query.

[spp125 (Mike)]

Hi,

The document I mention above is one of the many users. That doc does not have isServiceAccount field but there are many others docs which have isServiceAccount .

[ropc (Romain Chanu)]

memberOf.groupName is a multi-field and if you use memberOf.groupName, it is of type text. The default analyser being used is the standard analyzer which removes punctuation (so the - character is being removed during tokenisation). You can verify the same by using the analyze API. For example:

GET /_analyze
{
  "analyzer" : "standard",
  "text" : "ad-users"
}

If you want to perform an exact match, then you will need to use memberOf.groupName.keyword (keyword fields are not analysed). Otherwise, you will need to use a different analyser to meet your requirements.