Problem with filter

Elastic Stack Elasticsearch
#1

Hi community

I'm quite new to Elastic and have run into some obstacles.

I want to do a search on a specific company id, with filters, but can't it to work, although it works with query.

Why is that?

curl --location --request GET 'http://elastic1-test.server.com:9200/estransactionse*/_search?q=companyId:123&size=10&track_total_hits=true&pretty=true'

Works, get hits.

curl --location --request GET 'http://elastic1-test.server.com:9200/estransactionse*/_search?q=companyId:123&size=10&track_total_hits=true&pretty=true'
Works, get hits.
curl --location --request GET 'http://elastic1-test.server.com:9200/estransactionse*/_search?pretty' \
--header 'Content-Type: application/json' \
--data-raw '{
    "query": {
        "bool": {
            "filter": {
                "term": { "companyId": "123" }
            }
        }
    }
}'

Doesn't work.

#2

Welcome!

Are you sure that you example is correct?
I mean that with 123 that should behave the same in my opinion.

Anyway, that's because you are using a term query on a text field which is analyzed.
Use a simple query string query if you want to mimic what the q= parameter is doing.

#3

Hi and thanks
No, my bad, "123" is actually a base64 string.
If I use a simple query string, I'll also get a calculated score (that I don't need), therefore I wanted to use filters.
I'm now re-creating the indices, with companyId being of type keyword instead of text.
Is that the right way to go?
Thanks.

#4

Yes it is. Or if you don't want to aggregate or sort, you can use a text field with a keyword analyzer.

#5

Thanks, are there any performance implications to choose one over the other?
It's an ID, so it won't be sorted by, but it could be so that I want all transactions for a certain companyId, would that be an aggregation?
Besides your answer, I'm grateful for any links you can recommend on this topic.

#6

So that's a search. The keyword datatype also generates other data structures on disk to run fast aggs and sort, called doc values. Here you don't need that so using a text type would probably be better in term of disk space. It does not change anything IMO regarding the response time.

#7

Great, thanks for the input, will read more on this. Have a great weekend