# Search questions

**URL:** <https://discuss.elastic.co/t/search-questions/3256>\
**Category:** Elasticsearch\
**Created:** [August 25, 2010, 7:21am UTC](https://discuss.elastic.co/t/search-questions/3256 "2010-08-25T07:21:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Degtiariov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_degtiariov/32/3223_2.png) [@Andrew\_Degtiariov](https://discuss.elastic.co/u/Andrew_Degtiariov)\
**Post date:** [August 25, 2010, 7:21am UTC](https://discuss.elastic.co/t/search-questions/3256/1 "2010-08-25T07:21:38Z")

</div>

Hello!  
I have index with documents which have dynamic set of fields:  
{  
....  
'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx',  
'fields': [  
{  
'name': 'first\_name', 'value': ['First']  
},  
{  
'name': 'last\_name', 'value': ['Last']},  
{  
'name': 'phone', 'value': ['+000000000']  
}  
],  
...  
}

I need to handle 2 kinds of search requests.

1. Search only for documents which have specific field ('email' for  
example) and ignore other.
2. Search for documents specific fields of which should match search  
criteria (for example display only documents which fields with names  
'first\_name', 'last\_name' or 'email' starts from 'a')

For first type of search request I'm create the following search query:

{  
'query': {  
'filtered': {  
'filter': {  
'and': {  
'filters': [  
{  
'term': { 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx'}  
},  
{  
'term': { 'fields.name': 'email'}  
},  
]  
}  
},  
'query': {  
'prefix': {  
'fields.value' :'f'  
}  
}  
}  
}

I'm expected this query should filter out documents without 'email' in  
'fields' object but its is present in response.

For second type of search request I have no idea. Search query may look like:

{  
'query': {  
'filtered': {  
'filter': {  
'and': {  
'filters': [  
{  
'term': { 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx'}  
},  
{  
'term': { 'fields.name': 'email'}  
},  
]  
}  
},  
'query':  
{  
'prefix': {  
'fields.value' :'f'  
}  
}  
}  
}

--  
Andrew Degtiariov  
DA-RIPE

---

<div class="post-metadata">

**Author:** ![Andrew\_Degtiariov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_degtiariov/32/3223_2.png) [@Andrew\_Degtiariov](https://discuss.elastic.co/u/Andrew_Degtiariov)\
**Post date:** [August 25, 2010, 7:26am UTC](https://discuss.elastic.co/t/search-questions/3256/2 "2010-08-25T07:26:18Z")

</div>

Ooops, sorry I have send uncompleted message.

2010/8/25 Andrew Degtiariov [andrew.degtiariov@gmail.com](mailto:andrew.degtiariov@gmail.com):

> Hello!  
> I have index with documents which have dynamic set of fields:  
> {  
> ....  
> 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx',  
> 'fields': [  
> {  
> 'name': 'first\_name', 'value': ['First']  
> },  
> {  
> 'name': 'last\_name', 'value': ['Last']},  
> {  
> 'name': 'phone', 'value': ['+000000000']  
> }  
> ],  
> ...  
> }
> 
> I need to handle 2 kinds of search requests.
> 
> 1. Search only for documents which have specific field ('email' for  
> example) and ignore other.
> 2. Search for documents specific fields of which should match search  
> criteria (for example display only documents which fields with names  
> 'first\_name', 'last\_name' or 'email' starts from 'a')
> 
> For first type of search request I'm create the following search query:
> 
> {  
> 'query': {  
> 'filtered': {  
> 'filter': {  
> 'and': {  
> 'filters': [  
> {  
> 'term': { 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx'}  
> },  
> {  
> 'term': { 'fields.name': 'email'}  
> },  
> ]  
> }  
> },  
> 'query': {  
> 'prefix': {  
> 'fields.value' :'f'  
> }  
> }  
> }  
> }
> 
> I'm expected this query should filter out documents without 'email' in  
> 'fields' object but its is present in response.
> 
> For second type of search request I have no idea. Search query may look like:

{  
'query': {  
'filtered': {  
'filter': {  
'and': {  
'filters': [  
{  
'term': { 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx'}  
}  
]  
}  
},  
'query': {  
'or': [  
{  
'and': [  
{ 'prefix': { ''fields.value' :'f' },  
{ 'term': { 'field.name': 'email' }  
]  
},  
{  
'and': [  
{ 'prefix': { ''fields.value' :'f' },  
{ 'term': { 'field.name': 'first\_name' }  
]  
},  
{  
'and': [  
{ 'prefix': { ''fields.value' :'f' },  
{ 'term': { 'field.name': 'last\_name }  
]  
}  
]  
}  
}  
}  
}

--  
Andrew Degtiariov  
DA-RIPE

---

<div class="post-metadata">

**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\
**Post date:** [August 27, 2010, 12:00pm UTC](https://discuss.elastic.co/t/search-questions/3256/3 "2010-08-27T12:00:20Z")

</div>

Hi,

The way queries on multi fields works is not by actually returning only  
the documents where both fields exists, but think of it as a each one  
reduces the documents to search on, and each one works against the whole  
document. So, in your case, the filter does filter only for documents that  
have email in the "fields.name", but then the prefix query will match on  
_any_ fields.value that starts with f.

I think that a better solution for this is to move the "fields.name" to  
be fields level document fields, for example:

{  
"company\_id" : "xxxx",  
"first\_name" : "first",  
"last\_name" : "last",  
"phone" : "..."  
}

This will allow you to do what you want. And thanks to the fact that  
fields gets added dynamically, you can add other fields as you go.

-shay.banon

On Wed, Aug 25, 2010 at 10:26 AM, Andrew Degtiariov \<  
[andrew.degtiariov@gmail.com](mailto:andrew.degtiariov@gmail.com)\> wrote:

> Ooops, sorry I have send uncompleted message.
> 
> 2010/8/25 Andrew Degtiariov [andrew.degtiariov@gmail.com](mailto:andrew.degtiariov@gmail.com):
> 
> > Hello!  
> > I have index with documents which have dynamic set of fields:  
> > {  
> > ....  
> > 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx',  
> > 'fields': [  
> > {  
> > 'name': 'first\_name', 'value': ['First']  
> > },  
> > {  
> > 'name': 'last\_name', 'value': ['Last']},  
> > {  
> > 'name': 'phone', 'value': ['+000000000']  
> > }  
> > ],  
> > ...  
> > }
> > 
> > I need to handle 2 kinds of search requests.
> > 
> > 1. Search only for documents which have specific field ('email' for  
> > example) and ignore other.
> > 2. Search for documents specific fields of which should match search  
> > criteria (for example display only documents which fields with names  
> > 'first\_name', 'last\_name' or 'email' starts from 'a')
> > 
> > For first type of search request I'm create the following search query:
> > 
> > {  
> > 'query': {  
> > 'filtered': {  
> > 'filter': {  
> > 'and': {  
> > 'filters': [  
> > {  
> > 'term': { 'company\_id':  
> > 'xxxxxxxxxxxxxxxxxxxxxxx'}  
> > },  
> > {  
> > 'term': { 'fields.name': 'email'}  
> > },  
> > ]  
> > }  
> > },  
> > 'query': {  
> > 'prefix': {  
> > 'fields.value' :'f'  
> > }  
> > }  
> > }  
> > }
> > 
> > I'm expected this query should filter out documents without 'email' in  
> > 'fields' object but its is present in response.
> > 
> > For second type of search request I have no idea. Search query may look  
> > like:
> 
> {  
> 'query': {  
> 'filtered': {  
> 'filter': {  
> 'and': {  
> 'filters': [  
> {  
> 'term': { 'company\_id': 'xxxxxxxxxxxxxxxxxxxxxxx'}  
> }  
> ]  
> }  
> },  
> 'query': {  
> 'or': [  
> {  
> 'and': [  
> { 'prefix': { ''fields.value' :'f' },  
> { 'term': { 'field.name': 'email' }  
> ]  
> },  
> {  
> 'and': [  
> { 'prefix': { ''fields.value' :'f' },  
> { 'term': { 'field.name': 'first\_name' }  
> ]  
> },  
> {  
> 'and': [  
> { 'prefix': { ''fields.value' :'f' },  
> { 'term': { 'field.name': 'last\_name }  
> ]  
> }  
> ]  
> }  
> }  
> }  
> }
> 
> --  
> Andrew Degtiariov  
> DA-RIPE

---

<div class="post-metadata">

**Author:** ![Andrew\_Degtiariov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_degtiariov/32/3223_2.png) [@Andrew\_Degtiariov](https://discuss.elastic.co/u/Andrew_Degtiariov)\
**Post date:** [August 31, 2010, 1:19pm UTC](https://discuss.elastic.co/t/search-questions/3256/4 "2010-08-31T13:19:27Z")

</div>

2010/8/27 Shay Banon [shay.banon@elasticsearch.com](mailto:shay.banon@elasticsearch.com):

> Hi,  
> The way queries on multi fields works is not by actually returning only  
> the documents where both fields exists, but think of it as a each one  
> reduces the documents to search on, and each one works against the whole  
> document. So, in your case, the filter does filter only for documents that  
> have email in the "fields.name", but then the prefix query will match on  
> _any_ fields.value that starts with f.  
> I think that a better solution for this is to move the "fields.name" to  
> be fields level document fields, for example:  
> {  
> "company\_id" : "xxxx",  
> "first\_name" : "first",  
> "last\_name" : "last",  
> "phone" : "..."  
> }

Thank you, but for some purposes I have leave fields in structure of  
my document but convert it to be an object:  
{  
"company\_id": "xxxx",  
"fields" {  
"phone": ["ddddd", "bbbbbb"],  
"first\_name": ["first"],  
"last\_name": ["last"]  
}  
}

Now regular queries worked as expected but not more\_like\_this queries ☹

q1 = {  
"query": {  
"more\_like\_this": {  
"fields" : ["fields.email"],  
"like\_text" : "[pseudo.uzer@gmail.com](mailto:pseudo.uzer@gmail.com)"  
}  
}  
}

q2 = {  
"query": {  
"query\_string": {  
"query" : "fields.email: [pseudo.uzer@gmail.com](mailto:pseudo.uzer@gmail.com)"  
}  
}  
}

q1 match nothing but q2 match 2 documents.

Requests like '[http://localhost:9200/contacts/contact/XXXXXXXXXXXXXXXXXXXX/\_mlt?fields=fields.email](http://localhost:9200/contacts/contact/XXXXXXXXXXXXXXXXXXXX/_mlt?fields=fields.email)'  
don't show any matches too.

PS. I'm trying to match for field "company\_id" and get the same  
results (no matches)

--  
Andrew Degtiariov  
DA-RIPE

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:20am UTC](https://discuss.elastic.co/t/search-questions/3256/5 "2017-07-06T04:20:04Z")

</div>