Simple_query_string is not matching correctly

Elastic Stack Elasticsearch
,
1

I am trying the below query using simple_query_string to match customer_id

GET order-info/_search
{
  "query": {
    "simple_query_string": {
      "query": "1c0298d6-a911-5044-a904-6e848fb05eef",
      "fields": ["customer_id"]
    }
  },
    "sort": [
    {
        "created_date": "desc"
    }
  ],
  "from": 0,
  "size": 200,
  "_source": ["order_no", "customer_id"]
}

But this query is also matching this below which has a different customer_id

 {
    "_index" : "order-info",
    "_type" : "_doc",
    "_id" : "MAK1001803",
    "_score" : null,
    "_source" : {
      "order_no" : "MAK1001803",
      "customer_id" : "1c0298d6-a911-5044-a904-6e848fb18vit"
    },
    "sort" : [
      1680574801710
    ]
  },

If I use query string this issue is not happening. Can anyone help on why simpe_query_string is incorrectly matching this?

2

Hi @jilson

Are you using "default_operator": "AND" in query string?

I believe you are not declaring an analyzer in the customer_id field, so elasticsearch by default will apply the "standard" analyzer. This analyzer will generate several tokens for your customer Id ex: [1c0298d6, a911, 5044-a904, 6e848fb05eef], note that the token 1c0298d6 exists in doc 1c0298d6-a911-5044-a904-6e848fb18vit so this document will always be retrieved.

I would use the Term Query for this type of search (the customer id will have to be of the Keyword type) or if you want to keep the query string you will have to use the "default_operator": "AND" because that way you guarantee that all tokens are matched.

3

Hi @RabBit_BR

yes I am not declaring an analyzer in customer_id field, I am dumping the whole json into the index for now. I was going for the term query but it was giving no result, I believe due to customer_id currently being a text field.
I thought "AND" would be used as default in simple_query_string if no operator is provided.
Thanks for your response!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.