Search/Filter on exact keyword with email value

Elastic Stack Elasticsearch
1

We cannot find documents with an email keyword exact match. Other keywords work so I guess it's the @ symbol.

  • How do we /_search documents with exact keyword match
  • I thought keywords worked with exact match only (no tokenizer/analyzer complexity)
  • How can we /_analyze the query to understand it better

Mapping:

"properties": {
...
   "email": {
      "type": "keyword"
   }
...
}

Document:

_source: {
   "email": "foo@bar.com"
}

Search

  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "email: foo@bar.com"
          }
        }
      ]
    }
  }

OR

{
    "from": 0,
    "size": 100,
    "query": {
        "term": {
            "email": "foo@bar.com"
        }
    }
}

No Results:

{
    "took": 502,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 0,
            "relation": "eq"
        },
        "max_score": null,
        "hits": []
    }
}
2

Sorry, the issue was an incorrect mapping! What I posted was incorrect.

3

I have now updated the mapping on the index but it does not return the documents.

How can I "refresh" the index somehow?

My index (logs-000061) is part of ILM so I am unsure if I can reindex it to a temporary index, delete the original index, and reindex back?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.