Problem with filter

Hi community

I'm quite new to Elastic and have run into some obstacles.

I want to do a search on a specific company id, with filters, but can't it to work, although it works with query.

Why is that?

curl --location --request GET '*/_search?q=companyId:123&size=10&track_total_hits=true&pretty=true'

Works, get hits.

curl --location --request GET '*/_search?q=companyId:123&size=10&track_total_hits=true&pretty=true'
Works, get hits.
curl --location --request GET '*/_search?pretty' \
--header 'Content-Type: application/json' \
--data-raw '{
    "query": {
        "bool": {
            "filter": {
                "term": { "companyId": "123" }

Doesn't work.


Are you sure that you example is correct?
I mean that with 123 that should behave the same in my opinion.

Anyway, that's because you are using a term query on a text field which is analyzed.
Use a simple query string query if you want to mimic what the q= parameter is doing.

Hi and thanks
No, my bad, "123" is actually a base64 string.
If I use a simple query string, I'll also get a calculated score (that I don't need), therefore I wanted to use filters.
I'm now re-creating the indices, with companyId being of type keyword instead of text.
Is that the right way to go?

Yes it is. Or if you don't want to aggregate or sort, you can use a text field with a keyword analyzer.

Thanks, are there any performance implications to choose one over the other?
It's an ID, so it won't be sorted by, but it could be so that I want all transactions for a certain companyId, would that be an aggregation?
Besides your answer, I'm grateful for any links you can recommend on this topic.

So that's a search. The keyword datatype also generates other data structures on disk to run fast aggs and sort, called doc values. Here you don't need that so using a text type would probably be better in term of disk space. It does not change anything IMO regarding the response time.

Great, thanks for the input, will read more on this. Have a great weekend

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.