# Searching by ngrams

**URL:** <https://discuss.elastic.co/t/searching-by-ngrams/333872>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [May 19, 2023, 2:10pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872 "2023-05-19T14:10:38Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![orlenkoda5](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orlenkoda5/32/117648_2.png) [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\
**Post date:** [May 19, 2023, 2:10pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/1 "2023-05-19T14:10:39Z")

</div>

I use search with query string in index analyzed with ngrams.  
When I try to search doc with field\_1 = SU0001023277 it's ok. But when I try to use less letters, like SU0001023 the resultset is 0. Why it comes out like this?  
Index mapping:

```auto
PUT /instruments
{
"settings": {
"index": {
"max_ngram_diff": 20
},
"analysis": {
"analyzer": {
"autocomplete": {
"tokenizer": "autocomplete",
"filter": [
"lowercase"
]
},
"autocomplete_search": {
"tokenizer": "standard",
"filter": [
"lowercase"
]
}
},
"tokenizer": {
"autocomplete": {
"type": "ngram",
"min_gram": 1,
"max_gram": 15
}
}
}
},
"mappings": {
"properties": {
"field_1": {
"type": "text",
"analyzer": "autocomplete",
"search_analyzer": "autocomplete_search",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 19, 2023, 2:16pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/2 "2023-05-19T14:16:28Z")

</div>

Which version of Elasticsearch are you using?

What does your query look like?

---

<div class="post-metadata">

**Author:** ![orlenkoda5](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orlenkoda5/32/117648_2.png) [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\
**Post date:** [May 19, 2023, 2:57pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/3 "2023-05-19T14:57:31Z")

</div>

I use search template:

```auto
PUT _scripts/liquid_instruments_search
{
"script": {
"lang": "mustache",
"source": {
"query": {
"bool": {
"must": [
{
"match": {
"field_1": "true"
}
},
{
"match": {
"field_2": "true"
}
},
{
"match":{
"field_3":"true"
}
},
{
"bool": {
"should": [
{
"match": {
"field_4": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 4
}
}
},
{
"match": {
"field_5": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 3
}
}
},
{
"match": {
"field_6": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 2
}
}
},
{
"match": {
"field_7": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 1
}
}
}
]
}
}
]
}
},
"from": "{{from}}{{^from}}0{{/from}}",
"size": "{{size}}{{^size}}10{{/size}}"
},
"params": {
"query_string": "Query string"
}
}
}
GET instruments/_search/template
{
"id": "liquid_instruments_search",
"params": {
"query_string": "SU00090212",
"from": 0,
"size": 10
}
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 19, 2023, 3:03pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/4 "2023-05-19T15:03:18Z")

</div>

It looks like the query string does not get applied against field\_1, which you provided mapping for.

Please provide a full example that anyone can use to reproduce the issue. This includes mappings, settings, sample documents, data and queries run.

I also helps to know which version you are using.

---

<div class="post-metadata">

**Author:** ![orlenkoda5](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orlenkoda5/32/117648_2.png) [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\
**Post date:** [May 19, 2023, 3:43pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/5 "2023-05-19T15:43:53Z")

</div>

Sorry, here is correct template:

```auto
PUT _scripts/liquid_instruments_search
{
"script": {
"lang": "mustache",
"source": {
"query": {
"bool": {
"must": [
{
"match": {
"field_0": "true"
}
},
{
"match": {
"field_0.1": "true"
}
},
{
"match":{
"field_3":"true"
}
},
{
"bool": {
"should": [
{
"match": {
"field_1": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 4
}
}
},
{
"match": {
"field_2": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 3
}
}
},
{
"match": {
"field_3": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 2
}
}
},
{
"match": {
"field_4": {
"query": "{{query_string}}",
"fuzziness": "1",
"boost": 1
}
}
}
]
}
}
]
}
},
"from": "{{from}}{{^from}}0{{/from}}",
"size": "{{size}}{{^size}}10{{/size}}"
},
"params": {
"query_string": "Query string"
}
}
}
GET instruments/_search/template
{
"id": "liquid_instruments_search",
"params": {
"query_string": "SU00090212",
"from": 0,
"size": 10
}
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 19, 2023, 3:47pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/6 "2023-05-19T15:47:22Z")

</div>

Can you share a document you expect to match that does not?

> [@Christian\_Dahlqvist](#):
>
> Which version of Elasticsearch are you using?

Can you please also provide this information?

---

<div class="post-metadata">

**Author:** ![orlenkoda5](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orlenkoda5/32/117648_2.png) [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\
**Post date:** [May 19, 2023, 3:53pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/7 "2023-05-19T15:53:46Z")

</div>

Version is 7.17.5.

Here is the doc:

```auto
"hits" : [
{
"_index" : "instruments",
"_type" : "_doc",
"_id" : "144942",
"_score" : 14.99827,
"_source" : {
"actId" : "2100",
"isin" : "SU00090212777",
"objectId" : "174126",
"isLiquidBoard" : "true",
"lot" : "1"
}
}
]

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 19, 2023, 4:10pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/8 "2023-05-19T16:10:13Z")

</div>

The template seems to check that 3 fields (with different names) are set to `"true"` in addition to field\_1, but there is as far as I can see only 1 field set to `"true"` in the sample document. Please provide a full example that fully reproduces the issue.

---

<div class="post-metadata">

**Author:** ![orlenkoda5](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orlenkoda5/32/117648_2.png) [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\
**Post date:** [May 19, 2023, 4:56pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/9 "2023-05-19T16:56:55Z")

</div>

The problem is not in these fields. I wrote in my question, that I can find this doc with all conditions above when I search for the whole name of field\_1: "SU00090212777". But when I try to use this statement in query string: "SU0009021" the resultset is empty.

---

<div class="post-metadata">

**Author:** ![orlenkoda5](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orlenkoda5/32/117648_2.png) [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\
**Post date:** [May 19, 2023, 4:57pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/10 "2023-05-19T16:57:33Z")

</div>

And all other conditions are the same

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2023, 4:58pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872/11 "2023-06-16T16:58:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.