Please help me with how to search Elastic

Elastic Stack Elasticsearch
1

I am requesting a search on Elastic through the Java Elastic API.
Among them, I use queryStringQueryBuilder.

Let's say the field name I have in elastic is fruit.
Each field has a value of a-apple, b-apple, and c-apple.

And if I search for fruit: a-apple
All a-apples, b-apples, and c-apples are searched. How can I make them appear literally?

I searched for fruit.keyworld: a-apple, but at that time nothing was found.

This is how I did it.
fruit: a-apple
fruit.keyworld: a-apple
fruit: a\-apple

All search results do not show the "a-apple" I want.

2

Change the mapping. You can use a keyword analyzer instead of the standard analyzer (default) but it will force you to have exact matches.
May be you will need something a bit different and build your custom analyzer.

3

Thank you for answer.

I had a question about what you answered.

I searched and found out before I left a question, but read about changing the mapping.
But it understood that I am not changing the search api but changing the settings of the indices, did I understand correctly?.

If yes, I now have indices created automatically, not manually.

This is because the output in logstash is index-%yyyy.MM.dd.

If so, how can you change the mapping you made to default? What should I add to elasticsearch.yml?.

Or is there anything you can answer with the search api?

I am using version 6.8.
And it is in an environment where the version cannot be changed.

4

Yes.

You need to define this in an index template.

5

Thank you very much for your time.

Thanks to your help, I solved the problem. :smile:

6

Hello, I looked at the documents you gave me and created a template and tested it.

First, when I changed the field type to keyword, I saw that the analysis was not automatically performed and tried to change only this part.
{index_pattern: *,
mappings: {
properties: {
furit :{
type:keyword}}}}
I sent the command {ackowledged:true}
I thought it was applied since I came
If you still search for apple, you will see a-,b-,c-.

I don't understand exactly about analyze. What properties should I add to the template to get the result I want?

Second, if the template command is sent as above, will the field settings of the existing indexes be changed immediately? Or is the setting only applied to subsequent indexes?

The way I want is to find only the text value I searched for.
Elastic seems to automatically decompose the sentence I typed into words and understand it as analyze.
However, I want to search for a specific field without analysis.

For example, not a "like" search

7

Could you open a new question and also format your code?

8

Thank you so much for trying to help me for a long time.

I don't know what it means to open the new problem you mentioned and format the code.

I solved the problem with the search.
It gives the result I want if I put .keyword.

However, there are still some unsolved parts.
Adding a template causes an error saying that multiple types cannot be saved from elasticsearch 6.x version, but this part could not be solved.

Probably you need to change the type when sending from logstash, but I don't know how to do it.

Also, I use queryStringQueryBuilder and highlightBuilder, and I am not sure if highlightbuilder does not apply to search results with .keyword.

9

I meant: create a new topic.
About code formatting:

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

This is the icon to use if you are not using markdown format:

image
image764×92 16.4 KB

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.

10

Thank you very much for your kind response.

I'll try to solve it a little more, and then I'll open the problem again.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.