# Problem with search wrong result **URL:** \ **Category:** Elasticsearch\ **Created:** [May 30, 2018, 3:18pm UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904 "2018-05-30T15:18:28Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [May 30, 2018, 3:18pm UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/1 "2018-05-30T15:18:28Z")
I have mapping like : ```auto "382:FormattedValue": { "type": "string", "analyzer": "ExportRawAnalyzer", "ignore_above": 10922 }, "382:Value": { "type": "string", "fields": { "date": { "type": "date", "ignore_malformed": true, "format": "date_optional_time||epoch_millis||yyyy/MM/dd HH:mm:ss||yyyy/MM/dd HH:mm||yyyy/MM/dd||dd/MM/yyyy HH:mm:ss||dd/MM/yyyy HH:mm||dd/MM/yyyy||yyyy-MM-dd HH:mm:ss||yyyy-MM-dd HH:mm||yyyy-MM-dd||dd-MM-yyyy HH:mm:ss||dd-MM-yyyy HH:mm||dd-MM-yyyy||yyyy.MM.dd HH:mm:ss||yyyy.MM.dd HH:mm||yyyy.MM.dd||dd.MM.yyyy HH:mm:ss||dd.MM.yyyy HH:mm||dd.MM.yyyy||MM/dd/yy" } ``` I am hitting query like: ```auto GET index_name/item/_search { "query": { "bool": { "must": [ { "bool": { "must_not": [ { "exists": { "field": "382:Value" } } ] } } ] } }, "filter": { "bool": { "must": [ { "match": { "LanguageID": "1" } }, { "terms": { "_Parents": [ "13512" ] } } ] } }, "_source": "382:Value", "size": 200 } ``` In case of if I have huge value (might be more that 10922) for field 382 for any item, I am getting that item in result with above query. When I tried with reducing amount of content in field then query working fine. Don't know reason why with large content in field it's behaving wrongly. I am using elasticsearch version 2.4.0 Please guide me get it solve. Thank you. ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 1, 2018, 9:37am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/2 "2018-06-01T09:37:47Z")
> [@rokadeaks](#): > > Don't know reason why with large content in field it's behaving wrongly. See [ignore\_above | Elasticsearch Guide [2.4] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/ignore-above.html) > Strings longer than the ignore\_above setting will not be processed by the analyzer and will not be indexed. ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 1, 2018, 11:15am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/3 "2018-06-01T11:15:45Z")
But if you have look for mapping I don't have "ignore\_above" for my "382:value" Still it's not working what is the cause for it? ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 1, 2018, 1:32pm UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/4 "2018-06-01T13:32:57Z")
I formatted your example a bit to make it more readable (adding ``` before and after code snippets does that, for future reference). Can you share the full mapping and an example document that gets / does not get returned with your query? ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 4, 2018, 9:05am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/5 "2018-06-04T09:05:45Z")
Hi I have index setting as follow: ```auto "settings": { "index": { "creation_date": "1527835314570", "analysis": { "analyzer": { "ExportPrimaryAnalyzer": { "filter": "lowercase", "char_filter": "html_strip", "type": "custom", "tokenizer": "whitespace" }, "ExportRawAnalyzer": { "filter": "lowercase", "char_filter": "html_strip", "type": "custom", "tokenizer": "keyword" } } }, "number_of_shards": "5", "number_of_replicas": "0", "uuid": "dbgwZJtTRW6imK2AoZ1uIg", "version": { "created": "2040099" } } } ``` ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 4, 2018, 9:14am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/6 "2018-06-04T09:14:55Z")
sample document with which I am facing problem is as follow: ```auto { "_index": "export_cslive_mamfile", "_type": "item", "_id": "13515_1", "_version": 1, "found": true, ``` ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 4, 2018, 9:21am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/11 "2018-06-04T09:21:24Z")
Hi, I reformated your mappings using "```" again, please use that it makes it easier for everybody to read this. Also I cannot read your document the way you posted it across many comments. I don't know about any limitations about comment size here in the forum, but please either simplify your document or post it somewhere else like [https://pastebin.com/](https://pastebin.com/) or gist and share the link to make it possible to work with this. Thanks. ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 4, 2018, 9:27am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/12 "2018-06-04T09:27:12Z")
ok limit size for comment is only 7000 hence I unable to place whole document at once. ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 4, 2018, 9:31am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/13 "2018-06-04T09:31:17Z")
Here is link for sample document with which I have problem[doc\_link](https://pastebin.com/tnSq0vVt) ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 4, 2018, 10:15am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/14 "2018-06-04T10:15:34Z")
Thanks, still missing the full mapping, your example from the first comment is truncated, expecially the "382:Value" field mapping. But better post all. ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 4, 2018, 10:27am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/15 "2018-06-04T10:27:08Z")
Ok , here you can find full mapping: [mapping\_link](https://pastebin.com/hx5hhfCs) ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 4, 2018, 10:44am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/16 "2018-06-04T10:44:20Z")
From your mapping file: ```auto "382:Value": { "type": "string", "fields": { [...]}, "analyzer": "ExportPrimaryAnalyzer", "ignore_above": 10922 }, ``` The fields source in the document you linked is about 18748 characters, that explains why its dropped and appears in the bool-must-not-exists query. ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 4, 2018, 10:55am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/17 "2018-06-04T10:55:37Z")
so basically we need to remove "ignore\_above" or we need to increase size of it right? ---
**Author:** ![rokadeaks](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@rokadeaks](https://discuss.elastic.co/u/rokadeaks)\ **Post date:** [June 19, 2018, 8:47am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/18 "2018-06-19T08:47:34Z")
Is it possible to set ignore\_above at setting or configuration level, If I remove ignore\_above from mapping then I am getting exception. Can you please guide how can we handle such kind of situation. ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 19, 2018, 10:00am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/19 "2018-06-19T10:00:41Z")
> [@rokadeaks](#): > > Is it possible to set ignore\_above at setting or configuration level No, as far as I can tell only in the keyword mappings. > [@rokadeaks](#): > > If I remove ignore\_above from mapping then I am getting exception This is unexpected, the default value should be Integer.MAX\_VALUE which is 2147483647, but there is also a Lucene limit of 32766 characters per term which for good reasons cannot be increased. If you have longer fields, consider your general approach. ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 19, 2018, 10:02am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/20 "2018-06-19T10:02:20Z")
Also please see the note on the lucene limit on [https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html) for further information. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 17, 2018, 10:02am UTC](https://discuss.elastic.co/t/problem-with-search-wrong-result/133904/21 "2018-07-17T10:02:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.