Query_string with _all disabled still returns results

Elastic Stack Elasticsearch
1

I am running elasticsearch 5.3.1 and trying to understand the effects of disabling the _all field, however, after disabling I am still getting results on query_string queries where no field is specified. This is the same question as Query_string still returns results although _all field is disabled, however, it was not clearly answered.

Here are repro steps:

PUT mytest
{
  "mappings": {
    "Foo": {
      "dynamic": false,
      "_all": {"enabled": false},
      "properties": {
        "text_field": {
          "type": "text"
        }
      }
    }
  }
}

POST mytest/Foo
{
  "text_field": "search stuff"
}

GET mytest/_search?q=search

The _search query returns the one document, however, I was expecting to see no results.

2

I think that @dakrone might be able to comment.

Actually when you run

GET mytest/_search?q=_all:search

You get no hits (tested on 5.5.1). I know that we changed the behavior about _all field which is removed in 6.0. That might explain this.

Related breaking change: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/breaking_60_mappings_changes.html#_the_literal__all_literal_meta_field_is_now_disabled_by_default

3

This is because of the new all_fields mode that the query_string is using when no field is specified. It mimics the behavior of the _all field by expanding the query to be all fields that are queryable by default.

For the background, see: https://github.com/elastic/elasticsearch/pull/20925

You can also see exactly how the query is being rewritten with the following:

GET /mytest/_validate/query?explain&rewrite
{
  "query": {
    "query_string": {
      "query": "search"
    }
  }
}

Which returns:

{
  "valid" : true,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  },
  "explanations" : [
    {
      "index" : "mytest",
      "valid" : true,
      "explanation" : "text_field:search"
    }
  ]
}

You can see the text_field:search explanation, which explains why this matches the document.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.