# ES7.9.1 : match\_phrase\_prefix irregular behaviour
**URL:** https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022
**Category:** Elasticsearch
**Created:** [February 11, 2021, 1:34pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022 "2021-02-11T13:34:08Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@gap736uk](https://discuss.elastic.co/u/gap736uk)
#### Post date: [February 11, 2021, 1:34pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022/1 "2021-02-11T13:34:08Z")
We have an ES index of the 230 million + files in our archive - each file gets indexed with details such as filename, directory path and file size
I've been attempting to construct queries to aggregate information for a given directory path such as total volume and total number of files. For this I've been using match\_phrase\_prefix but seeing differing levels of reliability in the response i'm getting.
Here's two examples - in the first, for path `/badc/ukmo-midas/data/WM`, I'm expecting to get 77 hits.. in the second, for path `/badc/ukmo-midas/data/WH`149 hits.
the two paths are to directories which each have a couple of files and a sub-directory call 'yearly\_files' which contain data files for each year.
Here's my query
```auto
GET ceda-fbi/_search/
{"query": {
"match_phrase_prefix": {
"info.directory.analyzed": {"query":"/badc/ukmo-midas/data/WM",
}
}
}
}
```
This gets me just 4 results - 2 for the files in the directory as given in the query itself... and then just 2 from the 'yearly\_files' sub-directory.
Meanwhile:
```auto
GET ceda-fbi/_search/
{"query": {
"match_phrase_prefix": {
"info.directory.analyzed": {"query":"/badc/ukmo-midas/data/WH",
}
}
}
}
```
gives me 147 hits.. i.e. a lot closer to what I"m expecting to get.
I've also tried :
```auto
GET ceda-fbi/_search/
{"query": {
"match_phrase_prefix": {
"info.directory.analyzed": {"query":"/badc/ukmo-midas/data/WM/yearly_files",
}
}
}
}
```
In this case this gave the right number!... but we won't know what sub-directories we'll need to use a priori here. (use-case is to sum-up all files within a dataset based on the dataset giving a particular path in a directory hierarchy below which all the files are stored sub-divided into directories as needed)
I've tried changing the `max_expansions` up from 50 to 100 and then 1000. In the first case no change at 100, but I get the expected number when this gets to 1000. In the latter case, there was no change at any point.. i.e. the default of 50 was as good as for 100 and 1000.
As a quick aside - we did also try using match\_phrase - that seemed to work too... but we don't want that as order is important here to ensure we're getting the right directory path being picked up.
Whilst this _might_ appear to resolve the issue there are a few questions we are left with:
1. why does changing the max\_expansions work in this case as the methodology of the match\_phrase\_prefix should, from what we understand, work anyway for the given phrase against the field in question anyway.
2. [rhetorical question only] If we are mis-interpretting how the field is being checked against, then how will we know what to set the `max_expansions` to for all parts of the archive? That seems to much of an arbretary number for us to use this method in our use case.
3. Are we using the wrong query here - and instead should look at something like the much more expensive regexp query????
We've been scratching out heads about this one and tried to google/search here for an solution having read the docs and we're stuck.... any ES gurus able to shed some light please?
---
### Author:  [@rsmith013](https://discuss.elastic.co/u/rsmith013)
#### Post date: [February 11, 2021, 1:39pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022/2 "2021-02-11T13:39:42Z")
It is probably worth adding the field mapping:
```auto
{
"index_name" : {
"mappings" : {
"info.directory.analyzed" : {
"full_name" : "info.directory.analyzed",
"mapping" : {
"analyzed" : {
"type" : "text"
}
}
}
}
}
}
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [February 11, 2021, 1:54pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022/3 "2021-02-11T13:54:11Z")
I'd use a path tokenizer based analyzer.
In the past, I wrote something which might help you.
[http://david.pilato.fr/blog/2015/12/10/building-a-directory-map-with-elk/](http://david.pilato.fr/blog/2015/12/10/building-a-directory-map-with-elk/)
HTH
---
### Author:  [@gap736uk](https://discuss.elastic.co/u/gap736uk)
#### Post date: [February 11, 2021, 3:48pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022/4 "2021-02-11T15:48:34Z")
Thanks David.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 11, 2021, 3:49pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022/5 "2021-03-11T15:49:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.