Flattened fields with query_string and wildcards

Hi, I'm using Elasticsearch 8, and I'm having weird behaviors with flattened fields and query strings with wildcards.

Let's have this test index:


PUT test_index
{
  "mappings": {
    "properties": {
      "flattened_field": {
        "type": "flattened"
      }
    }
  }
}
POST test_index/_doc
{
  "flattened_field": {
    "name": "Im a name 123",
    "address": "Im an address 123"
  }
}

get test_index/_search
{
  "query": {
    "query_string": {
      "fields": ["flattened_field.name"], 
      "query": "*address*"
    }
  }

}

Notice that in my query, I'm querying for the field flattened_field.name but with an address value. I expect it will give me no results, but I do get my document. This is the result:

{
  "took" : 220,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "test_index",
        "_id" : "FqT5aoABa0sk6v_PNNcl",
        "_score" : 1.0,
        "_source" : {
          "flattened_field" : {
            "name" : "Im a name 123",
            "address" : "Im an address 123"
          }
        }
      }
    ]
  }
}

Moreover, even If I change the fields param to some non-existent sub-field of the flattened field, ti will still give me the same result.

get test_index/_search
{
  "query": {
    "query_string": {
      "fields": ["flattened_field.blablabla"], 
      "query": "*address*"
    }
  }
}

If I'm searching for value that does not exist in any field, it will give me no result, as expected:

get test_index/_search
{
  "query": {
    "query_string": {
      "fields": [
        "flattened_field.name"
      ],
      "query": "*zzzzz*"
    }
  }
}

It seems to me like it makes the search on all of the flattened_field sub fields, and not just on the one provided.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.