HOW-TO search a nested field ? [not working]

Elastic Stack Elasticsearch
1

hi guys,

if i have a JSON document indexed into Elasticsearch, like the following:

{
        "_index": "SNIP!",
        "_type": "SNIP!",
        "_id": "AVEHzwACg1ogiczjUHkz",
        "_score": 1,
        "_routing": "SNIP!",
        "_source": {
          "pid_no": 19321,
          "originator_ip": "SNIP!",
          "aggregator_id": null,
          "inet_family": "ipv4-unicast",
          "as_path": "SNIP!",
          "net_block": "SNIP!",
          "origin_code": "igp",
          "extended_community": null,
          "atomic_aggregate": null,
          "adv_type": "announce",
          "peer_ip": "SNIP!",
          "community_note": "SNIP!",
          "local_asn": "6830",
          "local_preference": 250,
          "med_metric": 0,
          "time_stamp": 1447534931,
          "peer_asn": "SNIP!",
          "cluster_list": "SNIP!",
          "net_mask": "23",
          "prefix4_": {
            "last": 222,
            "first": 111
          },
          "next_hop": "SNIP!",
          "counter_no": 69668,
          "confederation_path": "",
          "prefix_": "SNIP!",
          "local_ip": "SNIP!",
          "as_set": null,
          "host_name": "SNIP!"
        }
      }

and i have tried successfully to filter all of the keys of the doc, but, except the nested ones.

the query looks like:

    GET /SNIP!/SNIP!/_search?routing=SNIP!
    {
      "query": {
        "bool": {
          "must": {
            "query": {
              "query_string": {
                "query": "/SNIP!.*/",
                "fields": [
                  "as_path"
                ],
                "default_operator": "and",
                "use_dis_max": true
              }
            }
          },
          "must_not": {
            "query": {
              "simple_query_string": {
                "query": "-SNIP!",
                "fields": [
                  "community_note"
                ],
                "default_operator": "and"
              }
            }
          },
          "filter": {
            "bool": {
              "must": [
                {
                  "term": {
                    "prefix_": "SNIP!"
                  }
                },
                {
                  "range": {
                    "local_preference": {
                      "gt": 150,
                      "lte": 250
                    }
                  }
                }
,
            {
              "and": [
                {
                  "range": {
                    "prefix4_.first": {
                      "lte": 200
                    }
                  }
                },
                {
                  "range": {
                    "prefix4_.last": {
                      "gte": 200
                    }
                  }
                }
              ]
            }
              ],
              "must_not": [
                {
                  "terms": {
                    "originator_ip": [
                      "SNIP!"
                    ]
                  }
                }
              ]
            }
          }
        }
      }
    }

could a beautiful mind in here please advise on why the prefix4_ filter does not work ?
what i am doing wrong ?

Nikos

2

  • adding the mapping details:

    {
    "mappings": {
    "default": {
    "all": { "enabled": False },
    "dynamic": True,
    "routing": { "required": True },
    "properties": {
    "pid_no": { "type": "string", "index": "not_analyzed", "store": "no" },
    "counter_no": { "type": "long", "store": "no" },
    "time_stamp": { "type": "date", "format": "epoch_second", "store": "no" },
    "host_name": { "type": "string", "index": "not_analyzed", "store": "no" },
    "local_ip": { "type": "ip", "store": "no" },
    "peer_ip": { "type": "ip", "store": "no" },
    "local_asn": { "type": "string", "index": "not_analyzed", "store": "no" },
    "peer_asn": { "type": "string", "index": "not_analyzed", "store": "no" },
    "inet_family": { "type": "string", "index": "not_analyzed", "store": "no" },
    "next_hop": { "type": "ip", "store": "no" },
    "net_block": { "type": "string", "index": "analyzed", "store": "no" },
    "as_path": { "type": "string", "index": "analyzed", "store": "no" },
    "cluster_list": { "type": "string", "index": "not_analyzed", "store": "no" },
    "confederation_path": { "type": "string", "index": "not_analyzed", "store": "no" },
    "local_preference": { "type": "integer", "store": "no" },
    "originator_ip": { "type": "ip", "store": "no" },
    "origin_code": { "type": "string", "index": "not_analyzed", "store": "no" },
    "community_note": { "type": "string", "index": "analyzed", "store": "no" },
    "med_metric": { "type": "long", "store": "no" },
    "atomic_aggregate": { "type": "boolean", "store": "no" },
    "aggregator_id": { "type": "string", "index": "analyzed", "store": "no" },
    "as_set": { "type": "string", "index": "analyzed", "store": "no" },
    "extended_community": { "type": "string", "index": "not_analyzed", "store": "no" },
    "adv_type": { "type": "string", "index": "not_analyzed", "store": "no" },
    "prefix    ": { "type": "string", "index": "not_analyzed", "store": "no" },
    "net_mask": { "type": "integer", "store": "no" },
    "prefix4    ": {
    "type": "nested",
    "properties": {
    "first": { "type": "integer", "store": "no" },
    "last": { "type": "integer", "store": "no" }
    }
    },
    "prefix6_": {
    "type": "nested",
    "properties": {
    "lofirst": { "type": "long", "store": "no" },
    "lolast": { "type": "long", "store": "no" },
    "hifirst": { "type": "long", "store": "no" },
    "hilast": { "type": "long", "store": "no" }
    }
    }
    }
    }
    },
    "settings" : {
    "number_of_shards": 1,
    "number_of_replicas": 0,
    "index": {
    "store.throttle.type": "none",
    "memory.index_buffer_size": "20%",
    "refresh_interval": "1m",
    "merge.async": True,
    "merge.scheduler.type": "concurrent",
    "merge.policy.type": "log_byte_size",
    "merge.policy.merge_factor": 15,
    "cache.query.enable": True,
    "cache.filter.type": "node",
    "fielddata.cache.type": "node",
    "cache.field.type": "soft"
    }
    }
    }

3

i removed the "nested" (i was not aware of the difference between need document and nested object). problem solved.