Option to search matching phrase with post fix and prefix while maintaining the order in Elasticsearch 7.x

[Vithu]

I have a requirement to modify Elasticsearch query from 1.x to 7.x. The 1.x query is given below:

{
  "query": {
    "filtered": {
      "filter": {
        "and": {
          "filters": [
            {
              "terms": {
                "header": [
                  "target"
                ]
              }
            },
            {
              "range": {
                "date": {
                  "from": "2010-07-23",
                  "to": "2010-07-23",
                  "include_lower": true,
                  "include_upper": true
                }
              }
            },
            {
              "or": {
                "filters": [
                  {
                    "query": {
                      "match": {
                        "message": {
                          "query": "word1 word2 word3",
                          "type": "phrase",
                          "operator": "AND"
                        }
                      }
                    }
                  }
                ]
              }
            }
          ]
        }
      }
    }
  }
}

This query returns document if it contains word1 word2 word3 and also if the document has xxxxword1 word2 word3 or word1 word2 word3xxxx or xxxword1 word2 word3xxx.

Since the AND, OR operators support is deprecated in later Elasticsearch versions, I'm using should and must keywords and created below query to be complaint with 7.x:

{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "header": [
              "target"
            ]
          }
        },
        {
          "range": {
            "date": {
              "from": "2010-07-23",
              "to": "2010-07-23",
              "include_lower": true,
              "include_upper": true
            }
          }
        },
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "message": {
                    "query": "word1 word2 word3",
                    "analyzer": "keyword_analyzer"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}

But the new query does not return if the document contain xxxxword1 word2 word3 or word1 word2 word3xxxx or xxxword1 word2 word3xxx.

I tried adding "type": "bool_prefix" to the new query. but it gives more results than expected. is there any alternative to achieve this requirement?

Also, is there any performance issue in using match_phrase instead of multi_match with single field.

[dadoonet (David Pilato)]

Welcome!

Is the order of the terms important for you? Like if you have word2 word1, it should not match?

[Vithu]

yes correct. the words in the phrase should be in order.

word2 word1 should not be matched

[dadoonet (David Pilato)]

Ok. In order to move forward, could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script is something anyone can copy and paste in Kibana dev console, click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

Have a look at the Elastic Stack and Solutions Help · Forums and Slack | Elastic page. It contains also lot of useful information on how to ask for help.

That way, we can start from the script and try to adjust it to find a solution.