Query_string 'OR' doesn't work with keyword fields unless explicitly queried with OR

Elastic Stack Elasticsearch
2

Hi Varun,
The problem here is the fact you're searching untokenized keyword fields.
Whitespace could technically be a part of the content and this effects the way the query string is parsed.
I used the validate query API to inspect your query:

GET test/_doc/_validate/query?explain=true
{
	"query": {
	"query_string": {
	  "query": "0033568198782 0033698347370",
	  "analyze_wildcard": true,
	  "default_operator": "OR"
	}
  }
}

This gave back

"valid" : true,
"explanations" : [
{
  "index" : "test",
  "valid" : true,
  "explanation" : "+(imei:0033568198782 0033698347370 | imsi:0033568198782 0033698347370) #*:*"
}
]

Note that the two terms are seen as one seperated by whitespace (keyword fields can contain whitespace).
It is only the introduction of the OR in the query string that forces the parsing to ignore the whitespace.
You could try searching a form of text field instead - maybe using copy_to e.g.

PUT test
{
  "settings": {
	"number_of_replicas": 0,
	"number_of_shards": 1
  },
  "mappings": {
	"_doc":{
	  "properties":{
		"all_content":{
		  "type":"text"
		},
		"imsi":{
		  "type":"keyword",
		  "copy_to":"all_content"
		},
		"imei":{
		  "type":"keyword",
		  "copy_to":"all_content"
		}
	
	  }
	}
  }
}
POST test/_doc/1
{
  "imsi":"0033568198782"
}
POST test/_doc/2
{
  "imei":"0033698347370"
}
GET test/_doc/_search
{
  "query": {
	"query_string": {
	  "query": "0033568198782 0033698347370",
	  "analyze_wildcard": true,
	  "default_operator": "OR"
	}
  }
}
2 Likes