How do I create a query to perform the following

Elastic Stack Elasticsearch
1

My docs contain a single key value pair where the value is an array of words. I would like to find all docs that contain at least one of say “foo”, “bar”, “cloud” but exclude any that might have these words but also other words not specified in the original list. For example just foo passes. foo and bar pass. But foo and “sunny” is excluded since sunny is not in the acceptable list

2

Hi Kevin,

It seems that you can use the operator AND in your query:

First index the document:

POST my_index/doc/1
{
  "my_array": ["foo", "bar", "cloud"]
}

Use operator AND from match query:

POST my_index/_search
{
  "query": {
    "match": {
      "my_array": {
        "query": "foo bar",
        "operator": "AND"
      }
    }
  }
}

{
  "took": 0,
  ...
  "hits": {
    ...
    "hits": [
      {
        "_index": "my_index",
        "_type": "doc",
        "_id": "1",
        "_score": 0.5753642,
        "_source": {
          "my_array": [
            "foo",
            "bar",
            "cloud"
          ]
        }
      }
    ]
  }
}

Terms not present in the documents:

POST my_index/_search
{
  "query": {
    "match": {
      "my_array": {
        "query": "foo sunny",
        "operator": "AND"
      }
    }
  }
}

{
  "took": 0,
  ...
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

Hope it helps!
LG

3

Thanks luiz. So my situation is that it can ONLY have one or more of the set and no more. So for example, if I have 3 docs which are:
{
name: "doc1",
my_array: ["a", "b", "c", "d"]
}
{
name: "doc2",
my_array: ["a","b"]
}
{
name: "doc3",
my_array: ["a"]
}
My criteria is must have EITHER "a" or "b" or both but no more
So, doc1 fails, doc 2 and 3 pass

4

Hi Kevin,

That can be a little trick, but inspired on Finding Multiple Exact Values article you could do this:

POST my_index/doc/1
{
  "my_array": ["a","b","c","d"],
  "array_count": 4
}

POST my_index/doc/2
{
  "my_array": ["a","b"],
  "array_count": 2
}

POST my_index/doc/3
{
  "my_array": ["a"],
  "array_count": 1
}

Build your query combining multiple terms:

POST my_index/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "my_array": {
                    "query": "a"
                  }
                }
              },
              {
                "match": {
                  "my_array": {
                    "query": "b"
                  }
                }
              },
              {
                "match": {
                  "array_count": 2
                }
              }
            ]
          }
        },
        {
          "bool": {
            "must": [
              {
                "match": {
                  "my_array": {
                    "query": "a"
                  }
                }
              },
              {
                "match": {
                  "array_count": 1
                }
              }
            ]
          }
        },
        {
          "bool": {
            "must": [
              {
                "match": {
                  "my_array": {
                    "query": "b"
                  }
                }
              },
              {
                "match": {
                  "array_count": 1
                }
              }
            ]
          }
        }
      ]
    }
  }
}

Please let me know if that works for you.

Cheers,
LG

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.