Lucene query for AND operator is not working

Elastic Stack Elasticsearch
1

We are trying to use lucene search based on two fields below is the query we tried but we are not getting appropriate results.

GET test/message/_search
{
  "size": 180,
  "_source": [
    "host_name",
    "value",
    "item_name"
  ],
  "query": {
    "query_string": {
      "query": "host_name: debasish AND item_name: Agent ping"
    }
  }
}

The result we are getting as empty, however if we are using OR operator we are getting the results accurately. but we need the documents to match hostname_debasish and item_name: Agent Ping, I know we can write using bool -> must -> match conditions but we have to implement this in lucene based search. Please share your thoughts

2

How have your fields been mapped? Is item_name a keyword field? If so, try surrounding your query term with parentheses:

host_name: debasish AND item_name: (Agent ping)
3

@abdon Thanks, thats what I was looking for....

However, I am also facing another issue i.e.if in item_name I have something like

item_name: (Free disk space on /boot)

I am getting the below error

{
  "error": {
    "root_cause": [
      {
        "type": "query_shard_exception",
        "reason": "Failed to parse query [host_name: (Zabbix server) AND item_name: (Free disk space on /boot)]",
        "index_uuid": "buJiZeTmRu2CnZXXOWlVSw",
        "index": "zabbix_0"
      },
      {
        "type": "query_shard_exception",
        "reason": "Failed to parse query [host_name: (Zabbix server) AND item_name: (Free disk space on /boot)]",
        "index_uuid": "m8TdpmVQRbqg4PaqpZFuXA",
        "index": "zabbixbeat-6.8.4-0001.01.01"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "zabbix_0",
        "node": "FeQAdMiaTCmacOK_cl6nIQ",
        "reason": {
          "type": "query_shard_exception",
          "reason": "Failed to parse query [host_name: (Zabbix server) AND item_name: (Free disk space on /boot)]",
          "index_uuid": "buJiZeTmRu2CnZXXOWlVSw",
          "index": "zabbix_0",
          "caused_by": {
            "type": "parse_exception",
            "reason": "Cannot parse 'host_name: (Zabbix server) AND item_name: (Free disk space on /boot)': Lexical error at line 1, column 69.  Encountered: <EOF> after : \"/boot)\"",
            "caused_by": {
              "type": "token_mgr_error",
              "reason": "Lexical error at line 1, column 69.  Encountered: <EOF> after : \"/boot)\""
            }
          }
        }
      },
      {
        "shard": 0,
        "index": "zabbixbeat-6.8.4-0001.01.01",
        "node": "FeQAdMiaTCmacOK_cl6nIQ",
        "reason": {
          "type": "query_shard_exception",
          "reason": "Failed to parse query [host_name: (Zabbix server) AND item_name: (Free disk space on /boot)]",
          "index_uuid": "m8TdpmVQRbqg4PaqpZFuXA",
          "index": "zabbixbeat-6.8.4-0001.01.01",
          "caused_by": {
            "type": "parse_exception",
            "reason": "Cannot parse 'host_name: (Zabbix server) AND item_name: (Free disk space on /boot)': Lexical error at line 1, column 69.  Encountered: <EOF> after : \"/boot)\"",
            "caused_by": {
              "type": "token_mgr_error",
              "reason": "Lexical error at line 1, column 69.  Encountered: <EOF> after : \"/boot)\""
            }
          }
        }
      }
    ]
  },
  "status": 400
}

can you please help me on this?

4

Sure. The / is a special character that needs to be escaped. Try this query:

"item_name: (Free disk space on \\/boot)"

As you have noticed, the Lucene query syntax is a difficult to use. I'm not sure why your requirement would be to do this with Lucene queries. :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.