How to filter by sub-property?

Elastic Stack Elasticsearch
1

Hi,

I have documents alike:

{
"properties": {
"MessageId": "9a4e6f25-8493-4aea-9bd1-a5204adc5d70"
}
}

How do I make a query by the properties.MessageId?

I've tried:

POST http://localhost:9200/www/logs/_search

{
"query": {
"filtered": {
"filter": {
"term": {
"properties.MessageId": "9a4e6f25-8493-4aea-9bd1-a5204adc5d70"
}
}
}
},
"from": 0,
"size": 1000
}

but it does not return any document...

But doing a:

GET
http://localhost:9200/www/log/_search?size=1000&q=properties.MessageId:9a4e6f25-8493-4aea-9bd1-a5204adc5d70

does work... so how's the correct _search syntax?

Thanks!

-- RGL

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

the problem here is that your term filter is not passed through an analyzer
while the query use do below is. So the analyzer that is used splits on the
dash - and that is why you don't find anything. In other words the filter
looks for "9a4e6f25-8493-4aea-9bd1-a5204adc5d70" as a single string and the
query does ("9a4e6f25" OR "8493" OR "4aea-9bd1" OR "a5204adc5d70").

I guess in your case you want this field to be "not_analyzed" in the
mapping then the term filter works find.

simon
On Monday, May 27, 2013 9:05:49 PM UTC+2, Rui Lopes wrote:

Hi,

I have documents alike:

{
"properties": {
"MessageId": "9a4e6f25-8493-4aea-9bd1-a5204adc5d70"
}
}

How do I make a query by the properties.MessageId?

I've tried:

POST http://localhost:9200/www/logs/_search

{
"query": {
"filtered": {
"filter": {
"term": {
"properties.MessageId": "9a4e6f25-8493-4aea-9bd1-a5204adc5d70"
}
}
}
},
"from": 0,
"size": 1000
}

but it does not return any document...

But doing a:

GET
http://localhost:9200/www/log/_search?size=1000&q=properties.MessageId:9a4e6f25-8493-4aea-9bd1-a5204adc5d70

does work... so how's the correct _search syntax?

Thanks!

-- RGL

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

That was it! Thanks!

-- RGL

On Monday, May 27, 2013 8:05:49 PM UTC+1, Rui Lopes wrote:

Hi,

I have documents alike:

{
"properties": {
"MessageId": "9a4e6f25-8493-4aea-9bd1-a5204adc5d70"
}
}

How do I make a query by the properties.MessageId?

I've tried:

POST http://localhost:9200/www/logs/_search

{
"query": {
"filtered": {
"filter": {
"term": {
"properties.MessageId": "9a4e6f25-8493-4aea-9bd1-a5204adc5d70"
}
}
}
},
"from": 0,
"size": 1000
}

but it does not return any document...

But doing a:

GET
http://localhost:9200/www/log/_search?size=1000&q=properties.MessageId:9a4e6f25-8493-4aea-9bd1-a5204adc5d70

does work... so how's the correct _search syntax?

Thanks!

-- RGL

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.