Someone has better approach for array handling than nested objects?

Elastic Stack Elasticsearch
1

I've been a while playing with elastic search and(I think) I got a non-satisfied result from my queries. I would like to get all documents that must have four conditions puts inside but because an unknown reason I receive documents that accomplish 2-3 of 4 conditions.
I read on official documentation some about arrays that is not supported apply queries to objects independently from each other so i tried as nested property, I think this is a little bit confuse queries
Someone know a better approach to this situation?
Index object example

[
  {
    emails: [
      {
        accounts: [1,2,3,4],
        address: "abc@abc.com"
      }
    ],
    interactions: [
      {
        account_id: 1,
        type: "form",
        created: "2019-10-23 10:25:48",
        additional: {
          action: "one",
          id: 111
        }
      },
      {
        account_id: 1,
        type: "form",
        created: "2019-04-23 15:25:48",
        additional: {
          action: "one",
          id: 222
        }
      }
    ]
  },
  {
    emails: [
      {
        accounts: [3,4],
        address: "def@def.com"
      }
    ],
    interactions: [
      {
        account_id: 1,
        type: "form",
        created: "2013-11-23 00:25:48",
        additional: {
          action: "two",
          id: 111
        }
      },
      {
        account_id: 1,
        type: "form",
        created: "2016-07-03 04:25:48",
        additional: {
          action: "one",
          id: 222
        }
      }
    ]
  }
]

Query

{
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "interactions.interactable",
            "query": {
              "bool": {
                "must": [
                  { "term": { "interactions.additional.action.keyword": "two" } },
                  { "term": { "interactions.additional.id": 111 } } 
                ]
              }
            }
          }
        },
        {
          "nested": {
            "path": "emails",
            "query": {
              "bool": {
                "must": [
                  { "term": { "emails.address.keyword": "def@def.com" } }
                ]
              }
            }
          }
        }
      ]
    }
  }
}

I'll hope you can guide me about this.

ElasticSearch & Kibana on 7.3.0 version.

Kind regards,

2

can you share a full reproduction including your mapping, as the nested field also needs to be set up in the mapping correctly.

Thanks!

3

That's how it's works with nested params but when i use the same structure mapping without nested definition ES get confused also on its documentation said that arrays produces that because they don't have fully supported.
Now I'm read my own question also its confuse, jaja.
Just I'ld like to know if it has a better approach with same result as nested.

{
  "mapping": {
    "dynamic": "true",
    "properties": {
      "emails": {
        "type": "nested",
        "properties": {
          "accounts": {
            "type": "long"
          },
          "address": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      },
      "interactions": {
        "type": "nested",
        "properties": {
          "account_id": {
            "type": "long"
          },
          "created_at": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "additional": {
            "type": "nested",
            "properties": {
              "action": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              },
              "form_id": {
                "type": "long"
              }
            }
          },
          "type": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}
4

no, nested is the correct way of solving this. Basically the moment you have an array of data and searching in more than one field, then nested is the way to go.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.