Keyword analyzer expected behaviour

Elastic Stack Elasticsearch
1

Hi All,

I am analysing the field using keyword analyzer.

For example: Value of input record is -
{{98.138.26.90},{auto_remote@98.138.26.90}},{{192.168.50.73},{auto_local@98.138.26.90}}

I am using below queries for fetching the record:

Case 1: pass whole value : pass and getting result

"query_string" : {
"query" :
"c52:"{{98.138.26.90},{auto_remote@98.138.26.90}},{{192.168.50.73},{auto_local@98.138.26.90}}"",
"default_operator" : "and"
}
}}

Case 2: Fail, because I am getting records.

"query_string" : {
"query" : "c52:"{{98.138.26.90},{auto_remote@98.138.26.90}}"",
"default_operator" : "and"
}
}}

*Case3: *fail, because i am getting records.

"query_string" : {
"query" : "c52:"*[[*98.138.26.90},{auto_remote@98.138.26.90}}"",
"default_operator" : "and"
}
}}

I would like to use keyword analyzer instead of not_analyzed to provide
case-insensetive support.

Thanks,
Ankit

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Hi All,

Just like to add few things:

Case1: If i am passing whole value of field in query string, then i am
getting. So, this query is giving expected result.

Case2: If i am passing sub part of value of field in query string, then i
am also getting records. While the expected behaviour is no match.

Case3: If i am replacing "{" with "[", then also i am getting records.
While expected behaviour is no match.

Thanks,
Ankit

On Friday, 5 July 2013 14:02:18 UTC+5:30, Ankit Jain wrote:

Hi All,

I am analysing the field using keyword analyzer.

For example: Value of input record is - {{98.138.26.90},{
auto_remote@98.138.26.90}},{{192.168.50.73},{auto_local@98.138.26.90}}

I am using below queries for fetching the record:

Case 1: pass whole value : pass and getting result

"query_string" : {
"query" : "c52:"{{98.138.26.90},{auto_remote@98.138.26.90
}},{{192.168.50.73},{auto_local@98.138.26.90}}"",
"default_operator" : "and"
}
}}

Case 2: Fail, because I am getting records.

"query_string" : {
"query" : "c52:"{{98.138.26.90},{auto_remote@98.138.26.90}}"",
"default_operator" : "and"
}
}}

*Case3: *fail, because i am getting records.

"query_string" : {
"query" : "c52:"*[[*98.138.26.90},{auto_remote@98.138.26.90}}"",
"default_operator" : "and"
}
}}

I would like to use keyword analyzer instead of not_analyzed to provide
case-insensetive support.

Thanks,
Ankit

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Hey Ankit,

Can you mention your analyzer settings and/or index mapping?
Did you mean to have c52 as the field name or is it really part of the
query?
I did not understand the need to specify default operator as 'and'.

  • if c52 is a field name, you need to use a term query
    (Elasticsearch Platform — Find real-time answers at scale | Elastic), like
    this:
    {
    "term": {
    "c52": "{{98.138.26.90},{auto_remote@98.138.26.90}}"
    }
    }

  • if it is part of the query have quotes across the whole query string:
    {
    "query_string": {
    "query" : ""c52:{{98.138.26.90},{auto_remote@98.138.26.90}}"",
    "analyzer": "keyword"
    }
    }
    The reason we need to mention analyzer here is because in case of
    query_string query, analyzer is also applied to query string, default being
    standard analyzer. Since you want it to be not analyzed, specify the
    analyzer explicitly as 'keyword'.

  • Imdad

On Friday, July 5, 2013 2:02:18 PM UTC+5:30, Ankit Jain wrote:

Hi All,

I am analysing the field using keyword analyzer.

For example: Value of input record is - {{98.138.26.90},{
auto_...@98.138.26.90 <javascript:>}},{{192.168.50.73},{
auto_...@98.138.26.90 <javascript:>}}

I am using below queries for fetching the record:

Case 1: pass whole value : pass and getting result

"query_string" : {
"query" : "c52:"{{98.138.26.90},{auto_remote@98.138.26.90<javascript:>
}},{{192.168.50.73},{auto_...@98.138.26.90 <javascript:>}}"",
"default_operator" : "and"
}
}}

Case 2: Fail, because I am getting records.

"query_string" : {
"query" : "c52:"{{98.138.26.90},{auto_remote@98.138.26.90<javascript:>
}}"",
"default_operator" : "and"
}
}}

*Case3: *fail, because i am getting records.

"query_string" : {
"query" : "c52:"*[[*98.138.26.90},{auto_remote@98.138.26.90<javascript:>
}}"",
"default_operator" : "and"
}
}}

I would like to use keyword analyzer instead of not_analyzed to provide
case-insensetive support.

Thanks,
Ankit

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.