Query_string filter syntax bug (v1.7)

Elastic Stack Elasticsearch
1

im looking for the bug in the following query, as it doesn't bring any results. i want it to act like terms filter, and look for exact values in the country / device fields

    GET idx/type/_search
    {
     "query": {
     "filtered": {
      "filter": {
        "and": {
          "filters": [
            {
              "query": {
                "query_string": {
                  "query": "country:\"united kingdom\" AND device:\"desktop\""
                }
              }
            }
          ]
        }
      }
    }
    }
    }

specifically, this works:

 "query": {
                "query_string": {
                  "query": "\"united kingdom\""
                }
              }

but this doesnt work:

"query": {
                "query_string": {
                  "query": "country:\"united kingdom\""
                }
              }
2

Hi,

This query is basically a match all that filters on country and device. You can use a simple boolean query with 2 must clauses, each clause being a match query (or term query if your fields are not_analyzed)

3

i want to filter on not_analyzed field with case insensitive filter.
i think i have 3 options:

  1. reindex with another mapping
  2. use script filter
  3. query_string filter

i've edited the original post, with what exactly doesnt work

4

Can you please give us your mapping?

The query_string query can be very trappy, I personally prefer to use a combination ofbool, match or term queries.

Also, do you have control over the possible values for country and device fields? It looks like to me that the values come from a predefined set of values (maybe a drop down list in a web form?) If so, why not using term queries directly?

5 
"country": {
              "type": "string",
              "index": "not_analyzed",
              "doc_values": true
           },

country and device are indeed lists, but there are more fields that are not predefined, with long list of values.
if i want to reindex, with new mapping, can i keep somehow the original values, and also have the ability to search case-insensitive search?

6

Yes, see https://www.elastic.co/guide/en/elasticsearch/reference/2.1/_multi_fields.html

7

it starts with "Multi-fields are dead!" :slight_smile:

8

Yes, the feature has been renamed into fields :slightly_smiling: I linked to the breaking change page but the link to the document is: https://www.elastic.co/guide/en/elasticsearch/reference/2.1/multi-fields.html

9

thanks a lot man

10

You're welcome :slight_smile: