How to search within the same nested object

Elastic Stack Elasticsearch
1

Hej Girls and Boys,

i've got a little problem by finding the correct search query.

we have the following structure:

{
    "id":150163,
    "message_id":"<1yh4hj.icedbugudhz5z7t>",
    "created_at":"2015-07-22 06:07:35",
    "updated_at":"2015-07-26 19:20:38",
    "subscriber_id":2956,
    "values":[
        {
            "id":12320400,
            "custom_attribute_id":22,
            "value":"news@example.org",
            "model_type":"EmailHeader",
            "model_id":150163,
            "created_at":"2015-07-22 05:04:13",
            "updated_at":"2015-07-22 05:04:13",
            "deleted_at":null,
            "custom_attribute":{
                "id":22,
                "name":"from_address",
                "displayname":"from_address",
                "type":"text",
                "default_value":"",
                "options":"",
                "created_at":"10.06.15 ?.. 05:23",
                "updated_at":"26.11.15 ?.. 10:28",
                "deleted_at":"23.02.16 ?.. 10:34",
                "group_id":1,
                "required":0,
                "position":0,
                "created_by":1,
                "updated_by":1
            }
        },
        {
            "id":12320401,
            "custom_attribute_id":23,
            "value":"foo@example.org",
            "model_type":"EmailHeader",
            "model_id":150163,
            "created_at":"2015-07-22 05:04:13",
            "updated_at":"2015-07-22 05:04:13",
            "deleted_at":null,
            "custom_attribute":{
                "id":23,
                "name":"to_address",
                "displayname":"to_address",
                "type":"text",
                "default_value":"",
                "options":"",
                "created_at":"10.06.15 ?.. 05:23",
                "updated_at":"26.11.15 ?.. 10:28",
                "deleted_at":"23.02.16 ?.. 10:34",
                "group_id":1,
                "required":0,
                "position":0,
                "created_by":1,
                "updated_by":1
            }
        }
    ]
}

and I have this search query:

curl -XGET "http://localhost:9200/_search?pretty&size=1" -d '{
     "query" : {
         "query_string" : {
         	"query": "(values.custom_attribute_id:22 AND values.value:\"foo@example.org\")"
         }
     }
 }'

but this shouldn't match, because the string "foo@example.org" matches agains values.custom_attribute_id 23 so this query should return no result.

2

It's because elastic flattens all the data for the same field.

In that case, you need to use Nested docs. See https://www.elastic.co/guide/en/elasticsearch/guide/master/nested-objects.html

Note that you will have to use specific queries (Query DSL).