Mappings (Ignore_above)

Elastic Stack Elasticsearch
1

I have a field with data of numbers, letters, symbols, and the length of this dystrophy is more than 255, and I want to use term to return the data accurately, but it does not return anything, and when I use match, it returns field data similar to the value of the field I want, knowing that I have similar fields
How can I search this field with more than 255

2

Hi @dsagent

if you would like help, You will need to provide

  • Sample documents
  • Sample Mapping
  • Sample Query
  • Sample results
3

2024-07-13 21_11_18-172.20.10.41 - Remote Desktop Connection
2024-07-13 21_11_18-172.20.10.41 - Remote Desktop Connection810×258 258 KB

*this index

4

2024-07-13 21_14_17-172.20.10.41 - Remote Desktop Connection
2024-07-13 21_14_17-172.20.10.41 - Remote Desktop Connection305×513 96.7 KB

Sample Mapping

5

2024-07-13 21_13_01-172.20.10.41 - Remote Desktop Connection
2024-07-13 21_13_01-172.20.10.41 - Remote Desktop Connection807×163 96.7 KB

This is the search code

6

2024-07-13 21_13_25-172.20.10.41 - Remote Desktop Connection

results

7

Do not return the value even with the use of match

8

Apologies @dsagent ...
Ishould have bee more clear please do not post images of text, they are hard to read, can not be reproduced, can not be debugged (copied, pasted, tested etc) and some people can not see them...

Please repost all that as text then perhaps we can help

9 
PUT test/_doc/1
{
  "t1":"dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf",
  
  "t2":"http://dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf",
  
  "t3":"https://testdfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf"
}
10 
{
  "test": {
    "mappings": {
      "properties": {
        "t1": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "t2": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "t3": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}
11

Also are you trying to do an "Exact Match" if so you are going about it the wrong way... finish posting your text and we will fix.

You need to read about keyword and term query that is the correct approach

Typically you want to put the mapping first

AND

What is your MAX length for you data that you want to match against this can be quite large but as anything there will be some storage and performance tradeoffs at scale

And prefix / postfix your code with 3 Back Ticks

```

12

hi @dsagent

This all works as you like

Create the Mapping first set ignore_above to your max value
Notice term query that means exact match

DELETE discuss-test

PUT discuss-test/
{
  "mappings": {
    "properties": {
      "t1": {
        "type": "keyword",
        "ignore_above": 4096
      },
      "t2": {
        "type": "keyword",
        "ignore_above": 4096
      },
      "t3": {
        "type": "keyword",
        "ignore_above": 4096
      }
    }
  }
}


POST discuss-test/_doc
{
  "t1":"dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf",
  
  "t2":"http://dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf",
  
  "t3":"https://testdfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf"
}
      
      
GET discuss-test/_search
{
  "query": {
    "term": {
      "t1": {
        "value": "dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf"
      }
    }
  }
}

# Result
#! Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html to enable security.
{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 0.2876821,
    "hits" : [
      {
        "_index" : "discuss-test",
        "_type" : "_doc",
        "_id" : "bj9irZABfwsjeNV6fFhB",
        "_score" : 0.2876821,
        "_source" : {
          "t1" : "dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf",
          "t2" : "http://dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf",
          "t3" : "https://testdfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf"
        }
      }
    ]
  }
}
13

And technically this is even faster because a filter does not score

GET discuss-test/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "t1": {
              "value": "dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf"
            }
          }
        }
      ]
    }
  }
}
14

Thank you
I did it.
But it repeats all three fields, I want only one of these fields.

15

@dsagent

That is because elasticsearch returns the entire document by default.

Use the _source or fields parameter to return only the fields you want

See here

GET discuss-test/_search
{
  "_source": ["t1"], 
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "t1": {
              "value": "dfsghrsgf54h6ter5j3516rt485jh6t4h51gfd3h5e476rhj874tr53e6rh4f1h6e5rh476erh15eh65er46hjt51h6ewtr7e6rth5er67h468eh435frh16ewr58jh74r6tgfhe5r1h6rte85476t8rfh15er68th9wer6th4e5wr3jh74wtr96j74rw653n4ht6w98j743sdf98j7s9frdj46gfds3j4wsartj8rt4gnj6sag5jha6gf6e9rt6h4s5rgt6y84erthy563jh6wtrehjet65reyge46h8594eq6h54etrqa356qhe986r5h4q16rt9yhet74h65t3qe5t47y6w9ry745eqrqtq54ytq69yt54rwewporueyeuye09ryhrueuy0vcumryyrvwuoelyo16431561wcgegf"
            }
          }
        }
      ]
    }
  }
}
16

It worked
Thank you