Implementing Blacklist with Terms Lookup

Hi all,

I have a set of documents representing data of a phone call, basically from, to, duration
I want to implement a watcher that if a document with certain from number is being inserted an alarm is raised.
So I decide to use terms lookup, which works fine. :slight_smile: when the from field matches exactly the value in the document used in the lookup.

Now I have a question. Is it possible to match those documents containing the values used in the lookup as a substring?
The from field is of the type keyword .
For example

PUT /temp_sbc2/blacklist/3
  "to_block" : ["376875"] 

If I have a document containing from : 3768755588 I want that a similar query to this

GET /temp_sbc2/_search
    "query" : {
        "terms" : {
            "from" : {
                "index" : "temp_sbc2",
                "type" : "blacklist",
                "id" : "3",
                "path" : "to_block"

To return the document.

Thank you

Terms lookup works only with the terms query. So, you would need to index the from field twice - one time as not analyzed field for normal lookup and another time with an analyzer with edgeNGram filter, so you can find it by prefix.

Thank you @Igor_Motov

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.