"key:value" searches

Elastic Stack Elasticsearch
1

I've noticed that searches for documents that contain a string such as
key:value return unwanted results. For example, a search on:

"key:value"

returns results that include key AND value (eg. "key-value") but not
results that ONLY contain "key:value"

I've tried various combinations using a query_string query and escaping but
keep getting the unwanted results. It seems as though the escaped colon
removes it completely?

What's the best way to query on "key:value" and only return results that
contain "key:value"?

I'm using 0.19.1 and the standard analyzer

2

I think you should use a keyword analyzer for that field.

My 2 cents
David.

Le 16 avril 2012 à 17:45, Shane Witbeck shane@digitalsanctum.com a écrit
:

documents that contain a string such as key:value return unwanted results.
For example, a search on:

"key:value"

returns results that include key AND value (eg. "key-value") but not
results that ONLY contain "key:value"

I've tried various combinations using a query_string query and escaping but
keep getting the unwanted results. It seems as though the escaped colon
removes it completely?

What's the best way to query on "key:value" and only return results that
contain "key:value"?

I'm using 0.19.1 and the standard analyzer

--
David Pilato
http://dev.david.pilato.fr/
Twitter : @dadoonet

3

Would a keyword analyzer still be appropriate if the "key:value" string is
not the only text in the field? In my case, the field in question is text
from a forum post.

As an aside, is there a reference that explains in detail the different
analyzers and when to use them? I'm looking for more detail than what's in
the elasticsearch.org docs.

Thanks,
Shane

On Monday, April 16, 2012 11:57:34 AM UTC-4, David Pilato wrote:

I think you should use a keyword analyzer for that field.

My 2 cents

David.

Le 16 avril 2012 à 17:45, Shane Witbeck shane@digitalsanctum.com a
écrit :

I've noticed that searches for documents that contain a string such as
key:value return unwanted results. For example, a search on:

"key:value"

returns results that include key AND value (eg. "key-value") but not
results that ONLY contain "key:value"

I've tried various combinations using a query_string query and escaping
but keep getting the unwanted results. It seems as though the escaped colon
removes it completely?

What's the best way to query on "key:value" and only return results that
contain "key:value"?

I'm using 0.19.1 and the standard analyzer

--
David Pilato
http://dev.david.pilato.fr/
Twitter : @dadoonet

On Monday, April 16, 2012 11:57:34 AM UTC-4, David Pilato wrote:

I think you should use a keyword analyzer for that field.

My 2 cents

David.

Le 16 avril 2012 à 17:45, Shane Witbeck shane@digitalsanctum.com a
écrit :

I've noticed that searches for documents that contain a string such as
key:value return unwanted results. For example, a search on:

"key:value"

returns results that include key AND value (eg. "key-value") but not
results that ONLY contain "key:value"

I've tried various combinations using a query_string query and escaping
but keep getting the unwanted results. It seems as though the escaped colon
removes it completely?

What's the best way to query on "key:value" and only return results that
contain "key:value"?

I'm using 0.19.1 and the standard analyzer

--
David Pilato
http://dev.david.pilato.fr/
Twitter : @dadoonet

4

On Mon, Apr 16, 2012 at 18:20, Shane Witbeck shane@digitalsanctum.com wrote:

Would a keyword analyzer still be appropriate if the "key:value" string is
not the only text in the field? In my case, the field in question is text
from a forum post.

No, you either have to have an analyzer that tokenizes "key:value" as
"key:value", and not "key", "value", or you need to issue something
like a key AND value phrase query, or a bool/must query with both of
them, but of course both of those will find stuff like "the key is a
value" not just "key:value".