Search with _all missed some document

Elastic Stack Elasticsearch
1

Hi,

I run into a weird case, where i indexed three addresses as below.

{

"took": 2,
"timed_out": false,
"_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
},  
"hits": {
    "total": 3,
    "max_score": 1,
    "hits": [
        {   
            "_index": "my_test",
            "_type": "address",
            "_id": "1",
            "_score": 1,
            "_source": {
                "id_address": "1",
                "city": "Mountain View",
                "state": "CA",
                "postal_code": "94040",
                "location": "37.386177,-122.084026",
                "country_code": "US",
                "address": "1000 El Camino Real"
            }   
        },  
        {   
            "_index": "my_test",
            "_type": "address",
            "_id": "2",
            "_score": 1,
            "_source": {
                "id_address": "2",
                "city": "Mountain View",
                "state": "CA",
                "postal_code": "94040",
                "location": "37.386177,-122.084026",
                "country_code": "US",
                "address": "1001 El Camino Real"
            }   
        },  
        {   
            "_index": "my_test",
            "_type": "address",
            "_id": "3",
            "_score": 1,
            "_source": {
                "id_address": "3",
                "city": "Sunnyvale",
                "state": "CA",
                "postal_code": "94089",
                "location": "37.415568,-122.026123",
                "country_code": "US",
                "address": "700 First Ave"
            }   
        }   
    ]   
}

}

If I search use _all:sunnyvale, there was no hits. But if I use _all:mountain or _all:view, i got the 2 addresses in Mountain View. The Sunnyvale address can be hit using city:sunnyvale.

So why _all:sunnyvale" missed the address?

2

It might have something to do with my definition of the field "city"

city: {
"type":"string",
"analyzer":"snowball",
"filter":["word_delimiter", "standard"]
}

After i changed it to be simply

city: { "type": "string }

I could get the hit on the address. Next question: what's the default analyzer and filter for "string" type?

Thanks,

3

Reading the document again, i feel that if i use snowball as the analyzer, then i don't need to add "standard" token filter because it is used by snowball. I wonder if I have this

"type": "string",
"analyzer": "snowball",
"filter": ["word_delimiter", "standard"]

Will the list of filters OVERRIDE what the analyzer will use or simply be added as ADDITIONAL filters.

Thanks,