Not able to read reserved character in query dsl

Elastic Stack Elasticsearch
1

Hi,

I have some document fields with value like "CLOUD_TYPE": "AWS-EC2"

I'm trying below query to get the results, but it's giving me 0 values.
Please let me know the correct way to fetch the query

POST /aricloud/_search
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [
{
"match": {
"NODE_STATUS": "ACTIVE"
}
},
{
"constant_score": {
"filter": {
"term": {
"CLOUD_TYPE": ""aws"-ec2"
}
},
"boost": 1.2
}
}

          ] ,
          "must_not": [
             {
               "term": {
                 "NODE_ID": {
                  "value": "12235"
                }
            }     
             }
          ],
          "should": [
             {
                "term": {
                   "NODE_STATUS": {
                      "value": "active"
                   }
                } 
             }
          ]
       }
       },
       "filter": {
           "range": {
              "NODE_CREATE_TIME": {
                 "from": "2014-03-14 16:20:35",
                 "to": "2014-03-14 18:43:55"
              }
           }
       }
    }
},
"sort": [
   {
      "NODE_ID": {
         "order": "desc"
      }
   }
]

}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/fa712488-e8b1-4cc8-93c2-2029c4054558%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

probably your text has been analyzed with default analyzer.
"AWS-EC2" -> "aws", "ec2"

Term queries are not analyzed.

So you need to either send the exact same term which is in the inverted index either change your mapping and set it as not analyzed either use a MatchQuery instead which is analyzed.

My 2 cents

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr

Le 17 mars 2014 à 13:57:11, Subhadip Bagui (i.bagui@gmail.com) a écrit:

Hi,

I have some document fields with value like "CLOUD_TYPE": "AWS-EC2"

I'm trying below query to get the results, but it's giving me 0 values. Please let me know the correct way to fetch the query

POST /aricloud/_search
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [
{
"match": {
"NODE_STATUS": "ACTIVE"
}
},
{
"constant_score": {
"filter": {
"term": {
"CLOUD_TYPE": ""aws"-ec2"
}
},
"boost": 1.2
}
}

          ] ,
          "must_not": [
             {
               "term": {
                 "NODE_ID": {
                  "value": "12235"
                }
            }     
             }
          ],
          "should": [
             {
                "term": {
                   "NODE_STATUS": {
                      "value": "active"
                   }
                } 
             }
          ]
       }
       },
       "filter": {
           "range": {
              "NODE_CREATE_TIME": {
                 "from": "2014-03-14 16:20:35",
                 "to": "2014-03-14 18:43:55"
              }
           }
       }
    }
},
"sort": [
   {
      "NODE_ID": {
         "order": "desc"
      }
   }
]

}

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/fa712488-e8b1-4cc8-93c2-2029c4054558%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/etPan.5326f2e3.3dc240fb.1ccf%40MacBook-Air-de-David.local.
For more options, visit https://groups.google.com/d/optout.

3

Thanks David. Tried with below match query and it's working fine.
{
"match": {
"CLOUD_TYPE" : {
"query": "AWS-EC2",
"type": "phrase"
}
}

As you said I can send the exact same term which is in the inverted index.
Please let me know how to check the term which has been indexed and pass it
in query.

I tried to get the analyzed value like this,

*GET */_analyze?text=AWS-EC2
{

  • "tokens":[
    • {
      • "token":"aws",
      • "start_offset":0,
      • "end_offset":3,
      • "type":"",
      • "position":1
        },
    • {
      • "token":"ec2",
      • "start_offset":4,
      • "end_offset":7,
      • "type":"",
      • "position":2
        }
        ]

}

now I tried with this but no search result.
{ "filter": { "term": { "CLOUD_TYPE": "aws ec2" } } }

Thanks,
Subhadip

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8e7eb194-54d1-440d-a2ab-e57d15fb6f93%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

4

So the analyze API gave you that you have indexed 2 terms "aws" and "ec2".
It means that they are different terms, right?

The following filter tries to search for a single term "aws ec2" which does not exist in the inverted index.

{ "filter": { "term": {
"CLOUD_TYPE": "aws ec2" } } }

I think that you are after exact matching.
If so, you need to change your mapping and set "index": "not_analyzed" for "CLOUD_TYPE" field.

You will be able to filter using TermFilter:

{ "filter": { "term": {
"CLOUD_TYPE": "AWS-EC2" } } }

--
David Pilato | Technical Advocate | Elasticsearch.com
@dadoonet | @elasticsearchfr

Le 18 mars 2014 à 10:02:24, Subhadip Bagui (i.bagui@gmail.com) a écrit:

Thanks David. Tried with below match query and it's working fine.
{
"match": {
"CLOUD_TYPE" : {
"query": "AWS-EC2",
"type": "phrase"
}
}

As you said I can send the exact same term which is in the inverted index. Please let me know how to check the term which has been indexed and pass it in query.

I tried to get the analyzed value like this,

GET /_analyze?text=AWS-EC2

{

"tokens":[

{

"token":"aws",

"start_offset":0,

"end_offset":3,

"type":"",

"position":1

},

{

"token":"ec2",

"start_offset":4,

"end_offset":7,

"type":"",

"position":2

}

]

}

now I tried with this
but no search result.
{ "filter": { "term": {
"CLOUD_TYPE": "aws ec2" } } }

Thanks,
Subhadip

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8e7eb194-54d1-440d-a2ab-e57d15fb6f93%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/etPan.5328181f.643c9869.97ca%40MacBook-Air-de-David.local.
For more options, visit https://groups.google.com/d/optout.

5

I have changed mapping not to analyze and it's giving correct data. Also
tried with bool query for terms and giving correct search for exact match.
Got the logic now.
Thanks a lot.

Subhadip

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/afa79050-52f6-4846-a945-523ae7d7883a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.