How to query on a specific array index within elasticsearch?

Elastic Stack Elasticsearch
1 
Mapping: abc-data-type/_mapping/field/sData.status

{
    "abc_history": {
        "mappings": {
            "abc-data-type": {
                "sData.status": {
                    "full_name": "sData.status",
                    "mapping": {
                        "status": {
                            "type": "keyword"
                        }
                    }
                }
            }
        }
    }
}

My Json Response looks as below:

{
  "took": 41,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 3,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": null,
    "hits": [
      {
        "_index": "abc_history",
        "_type": "abc-data-type",
        "_id": "5e29cbb7965809fe6cb22a7b",
        "_score": null,
        "_source": {
          "sData": [
            {
              "status": "In Progress"
            },
            {
              "status": "Started"
            },
            {
              "status": "Finished"
            }
          ]
        },
        "sort": [
          1579797431366
        ]
      }
    ]
  }
}

My ES query looks as below which is returning the above response.

{
  "from": 0, 
  "size": 5, 
  "_source": ["sData.status"],
        "query": {
          "bool": {
            "must":[
              {
                "wildcard": {
                  "server": "*ABC2501*"
                }
              },         
              {
                "wildcard": {
                  "sData.status": "*Finish*"
                }
              }
            ]
          }
        },
        "sort": [
          { "requestDate": {"order": "desc"}}
        ]
}

I want to modify the query so that ES performs search in third element of sData which is sData[2]
I have modified the query as below and performing wildcard search for sData[2].status but it is not returning anything.

{
  "from": 0, 
  "size": 5, 
  "_source": ["sData.status"],
        "query": {
          "bool": {
            "must":[
              {
                "wildcard": {
                  "server": "*ABC2501*"
                }
              },         
              {
                "wildcard": {
                  "sData[2].status": "*Finish*"
                }
              }
            ]
          }
        },
        "sort": [
          { "requestDate": {"order": "desc"}}
        ]
}
2

Hey,

if you only want to search in the last element of an array, how about storing that value in an additional field named most_recent_status and just search in there?

--Alex

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.