Querying attachment arrays [ingest mapper plugin]

Hello,

In this example, how can I search the nested attachments? A simple example would be super helpful.

I am trying something like this but getting a nested object error:

{
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "attachments",
            "query": {
              "bool": {
                "must": [
                  {
                    "match": {
                      "attachments.content": "search text"
                    }
                  }
                ]
              }
            }
          }
        }
      ]
    }
  }
}

Anyone?

You ought to be able to pull a document containing an attachment to see the actual structure.

GET http://yourElasticSearchURL:9200/index/type/ID

What I think may be going on is that the ingest plugin actually creates another nested object inside your attachments object.

So, your match statement would need to be:
"attachments.attachment.content": "search text"

Does that make sense?

That doesn't work :confused:

Can you post a document you pull from your index? That would help in determining what the actual structure is and what the query needs to look like.

Here's a document:

{
    "_index": "localhost-1",
    "_type": "post",
    "_id": "496",
    "_score": 1,
    "_source": {
        "comment_count": 0,
        "post_title": ".....",
        "post_author": {
            "raw": "admin",
            "id": 1,
            "login": "admin",
            "display_name": "admin"
        },
        "menu_order": 0,
        "attachments": [
            {
                "data": "........",
                "attachment": {
                    "date": "2017-01-05T18:47:15Z",
                    "content_type": "application/pdf",
                    "author": "....",
                    "language": "en",
                    "content": "........",
                    "content_length": 3373
                }
            }
        ],
        "post_excerpt": "",
        "post_mime_type": "application/pdf",
        "post_name": "......",
        "terms": [],
        "post_modified": "2017-02-07 14:55:06",
        "post_type": "attachment",
        "ID": 496,
        "post_status": "inherit",
        "post_meta": [],
        "date_terms": {
            "week": 6,
            "dayofweek_iso": 2,
            "month": 2,
            "hour": 14,
            "year": 2017,
            "dayofweek": 2,
            "day": 7,
            "m": 201702,
            "dayofyear": 37,
            "minute": 55,
            "second": 6
        },
        "post_date_gmt": "2017-02-07 14:55:06",
        "post_modified_gmt": "2017-02-07 14:55:06",
        "comment_status": 0,
        "post_parent": 493,
        "post_content": "....",
        "ping_status": 0,
        "post_id": 496,
        "post_date": "2017-02-07 14:55:06",
        "meta": [],
        "guid": "...",
        "permalink": "..."
    }
}

Given that I'm getting the error "[nested] nested object under path [attachments] is not of nested type", it seems like a nested query is completely wrong.

Ah - I'm a bit slow (and really new to elasticSearch). I think you're right.

Did you explicitly set a mapping for this index/type? And did you define your attachments property as a nested object? If not, that would be why the nested query is not happy.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.