Implementing Blacklist with Terms Lookup

Elastic Stack Elasticsearch
1

Hi all,

I have a set of documents representing data of a phone call, basically from, to, duration
I want to implement a watcher that if a document with certain from number is being inserted an alarm is raised.
So I decide to use terms lookup, which works fine. :slight_smile: when the from field matches exactly the value in the document used in the lookup.

Now I have a question. Is it possible to match those documents containing the values used in the lookup as a substring?
The from field is of the type keyword .
For example

PUT /temp_sbc2/blacklist/3
{
  "to_block" : ["376875"] 
}

If I have a document containing from : 3768755588 I want that a similar query to this

GET /temp_sbc2/_search
{
    "query" : {
        "terms" : {
            "from" : {
                "index" : "temp_sbc2",
                "type" : "blacklist",
                "id" : "3",
                "path" : "to_block"
            }
        }
    }
}

To return the document.

Thank you
Regards!
Anna

2

Terms lookup works only with the terms query. So, you would need to index the from field twice - one time as not analyzed field for normal lookup and another time with an analyzer with edgeNGram filter, so you can find it by prefix.

3

Thank you @Igor_Motov
Regards
Ana

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.