ElasticSearch-6.8 - querying with hyphens in fields does not get results

I have a users index in that there is a field called groupName that have value like "ad-users" when I query to match how many users belong to "ad-users" groupName. Upon querying to match on groupName I got no results. Here is my query

{
  "bool": {
    "must": [
      {
        "query_string": {
          "query": "*",
          "default_operator": "OR"
        }
      },
      {
        "term": {
          "isServiceAccount": false
        }
      },
      {
        "match": {
          "memberOf.groupName": "ad-users"
        }
      }
    ]
  }
}

Please guide me on what I am doing wrong?

Welcome to our community! :smiley:

How is that field mapped?
Also please be aware that 6.8 is EOL and you should be looking to upgrade ASAP.

Thank you for your warm welcome.
Upgrading to latest version is in pipeline.

groupName field mapping is like this

 "groupName": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256.0
                }
              }
            },

Thank you

Seems a bit inconsistent (ad-user vs ad-users). Can you show a sample document you expect to match?

Hi Chris,

I have edited the post to be consistent. Sorry for any confusion.

{
    "_source": {
        "firstName": "Mike",
        "lastName": "Bankert",
        "name": "Mike Bankert",
        "memberOf": [
            {
                "groupName": "ad-users"
            }
        ]
    }
}

Above is one of document, but I have more users in my index.

That document does not have the isServiceAccout field, so should not match the query.

Hi,

The document I mention above is one of the many users. That doc does not have isServiceAccount field but there are many others docs which have isServiceAccount .

memberOf.groupName is a multi-field and if you use memberOf.groupName, it is of type text. The default analyser being used is the standard analyzer which removes punctuation (so the - character is being removed during tokenisation). You can verify the same by using the analyze API. For example:

GET /_analyze
{
  "analyzer" : "standard",
  "text" : "ad-users"
}

If you want to perform an exact match, then you will need to use memberOf.groupName.keyword (keyword fields are not analysed). Otherwise, you will need to use a different analyser to meet your requirements.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.