Guidance on mapping and query

Elastic Stack Elasticsearch
1

I have a question on what might be the best approach to structure my data. I have 8 indices that each contain about 4-7 fields (different ones), but I would like to search across all indices and multiple of those fields. I used the "copy_to" on a "search-as-you-type" field to copy all values into said field and use it for queries. Now the requirement arose, that we would like to boost certain fields, because they are more important. Do I just write a huge query that encompasses all relevant fields in all of those indices and gives them a boost factor or is there a better approach?

In terms of size our indices are not too big. The smallest being a couple of hundred entries and the largest approx. 250.000 entries.

Any advice is highly appreciated!

2

Welcome to our community! :smiley:

It'd be useful if you could share your mapping, the query and a sample document.

3

Of course! So for example I have a mapping that is like this:

"mappings": {
	"properties": {
		"search": {
			"type": "search_as_you_type"
		},
		"hostName": {
		  "type": "keyword",
		  "copy_to": "search"
		},
		"macAddress": {
		  "type": "keyword",
		  "copy_to": "search"
		},
		"publicIpAddress": {
			"type": "keyword",
			"copy_to": "search"
		},
		"link": {
			"type": "keyword"
		}
	}
}

And another example (keep in mind we got 8 different indices):

"mappings": {
	"properties": {
		"search": {
			"type": "search_as_you_type"
		},
		"componentVersion": {
			"type": "keyword",
			"copy_to": "search"
		},
		"productName": {
			"type": "keyword",
			"copy_to": "search"
		},
		"description": {
		  	"type": "text"
		},
		"link": {
			"type": "keyword"
		}
	}
}

And this is the query we have been using:

{ 
"size": 9, 
	"query": { 
		"multi_match": { 
			"query": <searchTerm>, 
			"type": "bool_prefix", 
			"fields": [ 
				"search^1.1", 
				"description" 
			]
		}
	}
}

And now we would like to implement per-field boosting. E.g. the IP-Address in index 1 should be more important than the version number in index 2. The component name on the other hand should be ranked higher than the MAC-Address. The query is supposed to be a navigational feature that autocompletes the user's input and suggests items they might want purely based on the prefix given.

Should we turn away from the "copy_to"-approach and put just more fields in the query (AFAIK that would be an anti-pattern regarding performance) or is there perhaps another more elegant solution?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.