Multi_field mappings and terms query

Elastic Stack Elasticsearch
1

Greetings,

I need to perform a terms query against a field that contains string data
that may contain whitespace. This an example of my current mapping:

"docType" : {
"type" : "multi_field",
"fields" : {
"docType" : {
"type" : "string"
},
"na" : {
"type" : "string",
"analyzer" : "keyword",
"include_in_all" : false
}
}
}

When I perform a terms query against that data, like this:

curl -XGET 'localhost:9200/test/_search?pretty=true' -d '{
"query" : {
"terms" : { "docType.na" : [ "compliance report", "other"] }
}
}'

I get the following:

{
"took" : 33,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [ ]
}
}

If I don't attempt to use the '.na' field I only get results for "other"
and not "compliance report." Does the in/terms query work against
multi_field mappings? If so, how do I use it?

Thanks,

-jason

2

Ok. I think I solved my own problem and will document it here.

I was automatically lowercasing the search values as they were added to the
terms collection. This is pretty standard for analyzed ES fields but for
the non-analyzed fields the matching is case sensitive.

So, when the data in the terms query changed from 'compliance report' to
'Compliance Report' the results magically came back.

Problem solved.

-jason

On Wednesday, June 13, 2012 3:59:34 PM UTC-4, Jason Yankus wrote:

Greetings,

I need to perform a terms query against a field that contains string data
that may contain whitespace. This an example of my current mapping:

"docType" : {
"type" : "multi_field",
"fields" : {
"docType" : {
"type" : "string"
},
"na" : {
"type" : "string",
"analyzer" : "keyword",
"include_in_all" : false
}
}
}

When I perform a terms query against that data, like this:

curl -XGET 'localhost:9200/test/_search?pretty=true' -d '{
"query" : {
"terms" : { "docType.na" : [ "compliance report", "other"] }
}
}'

I get the following:

{
"took" : 33,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" :
}
}

If I don't attempt to use the '.na' field I only get results for "other"
and not "compliance report." Does the in/terms query work against
multi_field mappings? If so, how do I use it?

Thanks,

-jason