I have a requirement to modify Elasticsearch query from 1.x to 7.x. The 1.x query is given below:
{
"query": {
"filtered": {
"filter": {
"and": {
"filters": [
{
"terms": {
"header": [
"target"
]
}
},
{
"range": {
"date": {
"from": "2010-07-23",
"to": "2010-07-23",
"include_lower": true,
"include_upper": true
}
}
},
{
"or": {
"filters": [
{
"query": {
"match": {
"message": {
"query": "word1 word2 word3",
"type": "phrase",
"operator": "AND"
}
}
}
}
]
}
}
]
}
}
}
}
}
This query returns document if it contains word1 word2 word3
and also if the document has xxxxword1 word2 word3
or word1 word2 word3xxxx
or xxxword1 word2 word3xxx
.
Since the AND, OR operators support is deprecated in later Elasticsearch versions, I'm using should and must keywords and created below query to be complaint with 7.x:
{
"query": {
"bool": {
"must": [
{
"terms": {
"header": [
"target"
]
}
},
{
"range": {
"date": {
"from": "2010-07-23",
"to": "2010-07-23",
"include_lower": true,
"include_upper": true
}
}
},
{
"bool": {
"should": [
{
"match_phrase": {
"message": {
"query": "word1 word2 word3",
"analyzer": "keyword_analyzer"
}
}
}
]
}
}
]
}
}
}
But the new query does not return if the document contain xxxxword1 word2 word3
or word1 word2 word3xxxx
or xxxword1 word2 word3xxx
.
I tried adding "type": "bool_prefix"
to the new query. but it gives more results than expected. is there any alternative to achieve this requirement?
Also, is there any performance issue in using match_phrase instead of multi_match with single field.