Hi,
I'm looking for a way to ignore part of a multi-field based on the value, like ignore_above does for strings that are too long.
Bit vague, so I'll explain my use case first:
I have a field in which information is stored about the sender of a text message (I've called it telnr). Nine out of ten cases this will be a (Dutch) telephone number, but it can be some text string (some companies send out text messages where they use their name instead of a number). In all of these cases I want to keep that as a string, and enable users to search on that string.
On the other hand, my users also want to search on telephone-numbers, but here there is a complication: my data comes from various sources, so telephonenumber can be 0612345678, +31612345678, 06-123 456 78, +31 (0) 6 12 34 56 78, etcetera, all the same. What matters in these cases are the last 9 numeric characters.
In order to enable my users to search on these values, I've made telnr a multifield, and added a field "last9", that stores the last 9 numbers (as keyword, with a custom normalizer).
This works fine, until I used Kibana's search box to search for "test". Elastic returned some documents that indeed included "test" in some other fields, but also returned several seemingly unrelated documents. I dug into it, and found that these were all documents where "telnr" was not a telephone number, but the name of some company. And elastic returned those documents, as my field telnr.last9 was an empty string (the last 9 digits of "Company Co" being nothing), just as my query "test" was an empty string when analyzed the same way.
So I'd like to be able to search on this field, when it contains valid data, but not when there's just text that doesn't give meaningful results. Is such a thing possible?
The way I came up with was that my problem could be solved if there was an option to disable the field "last9" altogether when it didn't pass a test. Similar to how keyword fields are not used when a string is too long and ignore_above is set. But I'm not sure whether this is the best solution, or whether there are other ways to accomplish what I want.
Thanks for any help!