Keyword type can't use field:(value1 value2) in querystring

Elastic Stack Elasticsearch
1

I have a Keyword type field,and can use querystring field:(value1 OR value2) get the result,but if remove the 'OR' it return empty.even though i set default_operator to "OR" in the querystring body,it still no effect,why?My es version is 6.2.2

full recreation script :

put mapping
PUT test/test/_mappings { "properties": { "test": { "type": "keyword" } } }
post docs
POST test/test/1 { "test": "1" } POST test/test/2 { "test": "2" }
and finally search
GET test/_search?q=test:(1 OR 2)
can get the result
{ "took": 13, "timed_out": false, "_shards": { "total": 5, "successful": 5, "skipped": 0, "failed": 0 }, "hits": { "total": 2, "max_score": 0.2876821, "hits": [ { "_index": "test", "_type": "test", "_id": "2", "_score": 0.2876821, "_source": { "test": "2" } }, { "_index": "test", "_type": "test", "_id": "1", "_score": 0.2876821, "_source": { "test": "1" } } ] } }
if i try
GET test/_search?q=test:(1 2)
it return rmpty

2

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

3

If i not put mapping first,and just post the data,it auto generate mapping like this:
"test": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
and this situation can work both test/_search?q=test:(1 2) or test/_search?q=test:(1 OR 2) . So what's different between type keyword to type keyword in type text

4

Difference is when you index something like "1 2 3" for example. With keyword you can search only for "1 2 3" where with text you can search for "1", "2", "3" for example.

5

I know this,my situation is index doc1 with "1" and doc2 with "2".With keyword i can search by querystring field:(1 OR 2),but can't get result by search field:(1 2),in querystring this is the same query.
With text i can search two doc in both method.

6

As I already said:

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

7

PUT test
PUT test/test/_mappings
{ "properties": { "test": { "type": "keyword" } } }
POST test/test/1
{ "test": "1" }
POST test/test/2
{ "test": "2" }
GET test/_search?q=test:(1 OR 2)
GET test/_search?q=test:(1 2)

8

Try:

GET test/_search?q=test:1 test:2
9

It's ok,But my code in 5.x is use by test:(1 2),I don't know why this can't be use in 6.x.

10

I use profile to find the reason,in 6.x querysring "test:(1 2)" translate to "test:1 2",where 5.x translate to "test:1 test:2",is it a bug in 6.x querystring?

11

@dakrone do you know?

12

query_string is using the analyzer for the field (in this case, the test field is a keyword, so the term is being analyzed as "1 2", which doesn't exist.

If you need to analyze the query string differently, you can specify an analyzer, both of these work:

GET /test/_search?q=test:(1+2)&analyzer=whitespace

and

GET /test/_search
{
  "query": {
    "query_string": {
      "query": "(1 2)",
      "analyzer": "whitespace"
    }
  }
}
13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.