Multi_match search with filtering working intermittently

[ryoga]

Hi, I am having issues trying to get muti_match with filtering, it seems to be working very intermittently depending on the term that I am filtering on and I can't pinpoint what the cause is. This is for ES 7.1. The query I am using is:

{
    "Keywords": [
      "personal grooming",
      "clothing",
      "employer expectations",
      "workplace rights and responsibilities",
      "inappropriate workplace behaviours",
      "misconduct",
      "employment"
    ],
    "Name": "Laptop",
    "Topic": [
      "Work culture",
      "Working conditions",
      "Job interviews",
      "Etiquette"
    ],
    "Year": [
      "Year 11",
      "Year 12"
    ]
    }
  }

This search successfully returns the record.

{
  "query": {
    "bool": {  
      "must" : {
        "multi_match" : {
          "query": "Laptop",
          "fields": ["Name"]
        }
      },
      "filter": {
        "term": {
          "Keywords": "clothing"
        }
      }
    }
  }
}

Changing the keyword to "personal grooming" returns no records. But just having "personal" does return the record? It can't handle multiple strings for the term?

Just a few more filtering examples:
"Year": "Year 11" - record NOT returned
"Topic": "Etiquette" - record NOT returned
"Topic": "work" - record IS returned
"Topic": "Job" - record NOT returned

So as mentioned working very intermittently and I can't pick out a pattern as to why, hope someone can help me out, driving me a little nuts.

Thanks

[dadoonet (David Pilato)]

Welcome.

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

This is the icon to use if you are not using markdown format:

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.

Here the problem is probably that you did not define any specific mapping so by default elasticsearch index the field for fulltext search reason and applies a default analyzer to your text.

If I'm still right, elasticsearch also generate another field named Keywords.keyword which is not analyzed.
Running your term query on this field would probably work.

[ryoga]

Thanks David for pointing out the formatting, looks much better now.
Yep I didn't not define any specific mappings, I will look into this.

As for filtering the term against Keywords.keyword, that is now working as expected, would you be able to point me in the direction of the documentation around this? If this is working, what would be the equivalent of trying to get the filtering against the Year and Topic working?

Thanks again for your time.

[ryoga]

Found the documentation:

So it'll be Year.keyword and Topic.keyword. Works now.

[dadoonet (David Pilato)]

If you don't need fulltext search on those fields but just exact match, it's better to control you mapping. That will avoid indexing twice the same content.

Have a look at

GET yourindex/_mapping

It will tell you what elasticsearch did by default.

[ryoga]

Perfect, thanks again David. Makes sense.