How to make range filter on a multi-field field?

Elastic Stack Elasticsearch
1

Here is the mapping file, I am using:

{

    "settings": {

        "number_of_shards": 2

    },

    "mappings": {

        "properties": {

            "SensitiveInfoTypeData": {

                "type": "nested",

                "properties": {

                    "Id": {

                        "type": "keyword"

                    },

                    "Count": {

                        "type": "keyword"

                    },

                    "Confidence": {

                        "type": "keyword",

                        "fields": {

                            "Raw": {

                                "type": "long"

                            }

                        }

                    }

                }

            }

        }

    }

}

PUT

{
    "SensitiveInfoTypeData": [
        {
            "Id": "Record1_id1",
            "confidence": 70,
            "confidence1": 70,
            "count": 1
        },
        {
            "Id": "Record2_id2",
            "confidence": 80,
            "confidence1": 80,
            "count": 2
        }
    ]
}

Question:

  1. How do I make a range query on the confidence field which has multi-field "keyword" & "long". This is what I am trying
{
    "query": {
        "nested": {
            "path": "SensitiveInfoTypeData",
            "query": {
                "range": {
                    "SensitiveInfoTypeData.confidence": {
                        "gt": 70,
                        "lt": 100
                    }
                }
            }
        }
    }
}

which is returning results as expected but I think it is working on the "keyword" and not on the "long" raw field. Could someone help me out with the right Range query here which will work on the Raw field inside confidence?

2

Wild guess. If you look at your mapping you probably have a field named Confidence and another one named confidence.

3

Thanks @dadoonet for the pointers. I can see another field appearing "confidence" on the mapping file after I ingest documents.

But I don't see this field getting generated in the mapping file in our PPE environment. Is there any setting which forces not to generate another field ?

4

Can't tell. May be you are not exactly doing the same thing in both envs?

Yes. See dynamic | Elasticsearch Guide [8.11] | Elastic

5

For us the dynamic =false which explains why new field it not being generated.

But still not able to understand what is the point of "Raw" field here? Isn't there an another way to reference the 'long' type 'Raw' field in the Query?

When "dynamic=false' then there is no point of below "fields' in the mapping file. Right?

"fields": {
                            "Raw": {

                                "type": "long"

                            }
}
6

If you don't need it, don't specify it in the mapping.

7

@dadoonet,

I meant is there any significance of below with flag "dynamic=false"?

"fields": {
                            "Raw": {

                                "type": "long"

                            }
}
8

I don't know. I'd need a full example to understand.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.