How to search through ingest attachments

[fedoroko (Alex)]

Hello, i'm installed elastic and ingest plagin but can't understand how to search through indexed attachments. Can you please explain how to build search query for attachments content?

PUT _ingest/pipeline/attachment?pretty
{
 "description" : "Extract attachment information from arrays",
 "processors" : [
   {
     "foreach": {
       "field": "attachments",
       "processor": {
         "attachment": {
           "target_field": "_ingest._value.attachment",
           "field": "_ingest._value.data"
         }
       }
     }
   }
 ]
}

PUT article/_doc/1?pipeline=attachment&pretty
{
 "attachments" : [
   {
      "filename" : "test_1.txt",
      "data" : "UEsDBBQACAgIACtHzU4AAAAAAAAAA*****"
    }
 ]
}

GET article/_doc/1?pretty
{
    "_index": "article",
    "_type": "_doc",
    "_id": "1",
    "_version": 2,
    "_seq_no": 39,
    "_primary_term": 3,
    "found": true,
    "_source": {
        "attachments": [
            {
                "filename": "test_1.txt",
                "data": "UEsDBBQACAgIACtHzU4AAAAAAAAAAAAAA*****",
                "attachment": {
                    "content_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                    "language": "hu",
                    "content": "Hello, find me!",
                    "content_length": 16
                }
            }
        ]
    }
}

Then trying

GET article/_search
{
  "query": {
    "match": {
      "attachments(or content or attachment etc)": {
        "query": "hello"
      }
    }
  }
}

But return 0 hits

[gbrown (Gordon Brown)]

You need to fully specify the path within the document to the field you want to search. Try adjusting your query to:

GET article/_search
{
  "query": {
    "match": {
      "attachments.attachment.content": {
        "query": "hello"
      }
    }
  }
}