# Multi\_match/query string with nested and "non-nested" fields

**URL:** https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652
**Category:** Elasticsearch
**Created:** [February 6, 2018, 1:30pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652 "2018-02-06T13:30:05Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![YeeP](https://avatars.discourse-cdn.com/v4/letter/y/41988e/32.png) [@YeeP](https://discuss.elastic.co/u/YeeP)
#### Post date: [February 6, 2018, 1:30pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/1 "2018-02-06T13:30:05Z")

</div>

EDIT: This setup is using Elasticsearch 6.1.3

Can this be done? I am trying to set up a front-end search that looks through several fields, so the multi-match and or query-string.

I would like to search in both the "number" field and the "update.statement" fields(as well as some others, but the combination of the nested and non-nested is where I am having trouble) . I have cut the large object down in size to just show the important fields as it is quite large.

```
module.exports = {
    mappings: {
        object: {
            properties: {
            company: {
                type: "text",
                fields: {
                raw: {
                    type: "keyword",
                    ignore_above: 256
                }
                }
            },
            number: {
                type: "text",
                fields: {
                raw: {
                    type: "keyword",
                    ignore_above: 256
                }
                }
            },
           <SNIP>
            update: {
                type: 'nested',
                properties: {
                level: {
                    type: "text",
                    fields: {
                    raw: {
                        type: "keyword",
                        ignore_above: 256
                    }
                    }
                },
                level_index: {
                    type: "integer"
                },
                snow_severity: {
                    type: "integer"
                },
                sites: {
                    type: 'nested',
                    properties: {
                    sys_id: {
                        type: "text",
                        fields: {
                        raw: {
                            type: "keyword",
                            ignore_above: 256
                        }
                        }
                    },
                    name: {
                        type: "text",
                        fields: {
                        raw: {
                            type: "keyword",
                            ignore_above: 256
                        }
                        }
                    }
                    }
                },
                impact: {
                    type: "text",
                    fields: {
                    raw: {
                        type: "keyword",
                        ignore_above: 256
                    }
                    }
                },
                statement: {
                    type: "text",
                    fields: {
                    raw: {
                        type: "keyword",
                        ignore_above: 256
                    }
                    }
                },
                submission_timestamp: {
                    type: "date"
                },
              <SNIP>
                }
            }
            }
        }
    }
}

```

This is the current search I am using which works great for just the "number field" (written in node.js)

```
    const multiSearch = (index, fields, query, from, size, sort) => config.elasticClient.search({
        index,
        type: 'object',
        body: {
            query: {
                query_string: {
                    query,
                    fields
                }
            }
        },
        from,
        size,
        sort
    })
```

---

<div class="post-metadata">

### Author: ![YeeP](https://avatars.discourse-cdn.com/v4/letter/y/41988e/32.png) [@YeeP](https://discuss.elastic.co/u/YeeP)
#### Post date: [February 6, 2018, 3:22pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/2 "2018-02-06T15:22:08Z")

</div>

Here is an example, although it does not work, for what I am talking about:

```
GET /sev_incidents/object/_search
{
    "query": {
        "query_string" : {
            "query" : "*Ryan*",
            "fields": ["number"]
        },
        "nested" : {
            "path" : "update",
            "score_mode" : "avg",
            "query": {
              "query_string" : {
                "query" : "*Ryan*",
                "fields": ["update.informant.name", "update.subject_line"]
              }
            }
        }
    }
}

```

RETURNS:

```
{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "[query_string] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line": 7,
        "col": 9
      }
    ],
    "type": "parsing_exception",
    "reason": "[query_string] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
    "line": 7,
    "col": 9
  },
  "status": 400
}
```

---

<div class="post-metadata">

### Author: ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [February 6, 2018, 3:29pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/3 "2018-02-06T15:29:55Z")

</div>

Multiple sibling query clauses (in your case `nested` and `query_string`) cannot just be listed alongside each other. Elasticsearch doesn't know if they should be ANDed or ORed together. Use a [bool](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html) query to contain these queries in the appropriate logic (e.g. a bool's `should` array to OR the contained query clauses)

---

<div class="post-metadata">

### Author: ![YeeP](https://avatars.discourse-cdn.com/v4/letter/y/41988e/32.png) [@YeeP](https://discuss.elastic.co/u/YeeP)
#### Post date: [February 6, 2018, 3:35pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/4 "2018-02-06T15:35:45Z")

</div>

Thanks, Mark, I am working on that now. Can you pass a wildcard into that bool query? I need to look for a partial match.

Thank you

---

<div class="post-metadata">

### Author: ![YeeP](https://avatars.discourse-cdn.com/v4/letter/y/41988e/32.png) [@YeeP](https://discuss.elastic.co/u/YeeP)
#### Post date: [February 6, 2018, 3:41pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/5 "2018-02-06T15:41:50Z")

</div>

Mark, this one seems to be working great!

```
GET /sev_incidents/object/_search
{
    "query": {
      "bool": {
        "should": [
          {"query_string" : {
            "query" : "*Alert*",
            "fields": ["number"]
            }
          },
          {
            "nested" : {
            "path" : "update",
            "score_mode" : "avg",
            "query": {
              "query_string" : {
                "query" : "*Alert*",
                "fields": ["update.level", "update.subject_line"]
              }
            }
            }
          }
        ]
      }
    }
}

```

Another question coming after I try this. I have a nested within nested but am assuming I can use the smae logic here.

---

<div class="post-metadata">

### Author: ![YeeP](https://avatars.discourse-cdn.com/v4/letter/y/41988e/32.png) [@YeeP](https://discuss.elastic.co/u/YeeP)
#### Post date: [February 6, 2018, 3:50pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/6 "2018-02-06T15:50:13Z")

</div>

Here is one that also combines a nested, nested object. Seems to function as expected. Keep in mind the application for this would be a "global search" for the front end where the user is searching through multiple fields with the same string. I recognize how this could be done better by defining data specific to the fields in question, which we will also do in a different part of the site.

```
GET /sev_incidents/object/_search
{
    "query": {
      "bool": {
        "should": [
          {"query_string" : {
            "query" : "*ALBANY* AND open:false",
            "fields": ["number"]
            }
          },
          {
            "nested" : {
            "path" : "update",
            "score_mode" : "avg",
            "query": {
              "query_string" : {
                "query" : "*ALBANY*",
                "fields": ["update.level", "update.subject_line"]
              }
            }
            }
          },
          {
            "nested" : {
            "path" : "update.sites",
            "score_mode" : "avg",
            "query": {
              "query_string" : {
                "query" : "*ALBANY*",
                "fields": ["update.sites.name"]
              }
            }
        }
          }
        ]
      }
    }
}

```

Thanks again for the help!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2018, 3:50pm UTC](https://discuss.elastic.co/t/multi-match-query-string-with-nested-and-non-nested-fields/118652/7 "2018-03-06T15:50:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
