Querying a not_analyzed field returning analyzed results

Elastic Stack Elasticsearch
1

I set a template mapping for an index like this:

PUT _template/test_template
{
"template" : "testsites-*",
"mappings": {
"type1": {
"properties": {
"testurl": {
"type":"string",
"index":"not_analyzed"
}
}
}
}
}

When I query the index for field testurl, I'm getting results like this:
"aggregations": {
"sites": {
"doc_count_error_upper_bound": 574889,
"sum_other_doc_count": 41123279,
"buckets": [
{
"key": "http",
"doc_count": 10190076
},
{
"key": "index",
"doc_count": 3673145
},

It seems like the field is still analyzed. When I do a get for the mapping of the index, I don't see the field as not_analyzed. Is the template not working correctly? If so, why?

2

Hi,

Did you re-index the data or delete your index, create a new index and add new data? Because just changing the template won't affect whats currently there. The template only adds the string as not_analyzed when a new index is created. It has no affect on existing indexes.

1 Like
3

I created a new index and added data.

4

Did you actually create the template? The only thing I see wrong is your missing _template:

PUT /_template/testtemplate
{
  "template": "testsites-*",
  "mappings": {
    "type1": {
      "properties": {
        "testurl": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}
GET /_template/testtemplate
{
   "testtemplate": {
      "order": 0,
      "template": "testsites-*",
      "settings": {},
      "mappings": {
         "type1": {
            "properties": {
               "testurl": {
                  "index": "not_analyzed",
                  "type": "string"
               }
            }
         }
      },
      "aliases": {}
   }
}

POST /testsites-123/type1/
{
  "testurl": "http://localhost/foo/bar"
}

GET /testsites-123/_search
{
  size: 0,
  "aggs": {
    "url_terms": {
      "terms": {
        "field": "testurl"
      }
    }
  }
}

The result is:

   "aggregations": {
      "url_terms": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "http://localhost/foo/bar",
               "doc_count": 1
            }
         ]
      }
5

Yes, I created the template. Here's what I get when I do a get on the template:

GET _template/test_template

    {
       "test_template": {
          "order": 0,
          "template": "testsites-*",
          "settings": {
             "index.number_of_replicas": "1",
             "index.number_of_shards": "3"
          },
          "mappings": {
             "site": {
                "properties": {
                   "siteurl": {
                      "index": "not_analyzed",
                      "type": "string"
                   }
                }
             }
          },
          "aliases": {}
       }
    }

I ran the same search you gave and still get analyzed terms:

GET /testsites-2015-09-21/_search
{
  size: 0,
  "aggs": {
    "url_terms": {
      "terms": {
        "field": "testurl"
      }
    }
  }
}

Here's the mapping for the index:

{
   "testsites-2015-09-21": {
      "mappings": {
         "site": {
            "properties": {
               "testurl": {
                  "type": "string"
               }
            }
         },
         "boardposts": {
            "properties": {
               "testurl": {
                  "type": "string",
                  "index": "not_analyzed"
               }
            }
         }
      }
   }
}