elasticSearch query_string not applying on .keyword version of field

Elastic Stack Elasticsearch
1

I am trying to query index with

{
	"query": {
		"query_string": {
			"query": "application_id:app-20231008232923-0060"
		}
	}
}

But records with application_id:app-20231008232923-0061 are also showing up in result
Here is my Index

{
	"devsakafka-logs-spark-info-2023.10.08": {
		"aliases": {},
		"mappings": {
			"doc": {
				"properties": {
					"@timestamp": {
						"type": "date"
					},
					"@version": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword",
								"ignore_above": 256
							}
						}
					},
					"application_id": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword",
								"ignore_above": 256
							}
						}
					},
....

Using elastic version 6.8.23
but in query if i use "application_id.keyword:app-20231008232923-0060" correct results are showing up
what i am missing?

2

Welcome!

One of the field is analyzed. Not the keyword field.

You could look at this video:

Or read Text analysis | Elasticsearch Guide [8.10] | Elastic

3

But exactly same settings working in another environment(example dev).
not given any specific analyzer

4

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script is something anyone can copy and paste in Kibana dev console, click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

Have a look at the Elastic Stack and Solutions Help · Forums and Slack | Elastic page. It contains also lot of useful information on how to ask for help.

It's also important that you upgrade to 7.17 at least.

5

Are the mappings exactly the same in the other environment?

6

By removing type text and using keyword tockenizer it worked for application_id it worked.
got to know how tockerizer works!!
thanks

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.