String contains Substring Search across one or more fields

Elastic Stack Elasticsearch
1

Hello. I am looking for analysis and mapping setting recommendations that would allow me to perform searches that answer 'does string Y contain substring X?'.

For example, given the sample data:

[
  {
    "name": {
      "first": "Garrett",
      "last": "Lee"
    },
    "company": "NORALI",
    "email": "garrett.lee@norali.biz",
    "phone": "+1 (815) 425-2523",
    "address": "795 Truxton Street, Kiskimere, New Mexico, 7346",
    "serialNumber": "64167f877a47",
    "ipAddress": "10.240.246.103",
    "registered": "Monday, February 5, 2018 2:40 AM"
  },
  {
    "name": {
      "first": "Kramer",
      "last": "Harper"
    },
    "company": "NSPIRE",
    "email": "kramer.harper@nspire.org",
    "phone": "+1 (860) 567-3581",
    "address": "678 Willoughby Street, Catherine, Marshall Islands, 4958",
    "serialNumber": "8219064D033CF2",
    "ipAddress": "10.12.64.47",
    "registered": "Sunday, January 17, 2016 12:42 PM"
  },
  {
    "name": {
      "first": "Mitzi",
      "last": "Merrill"
    },
    "company": "SPRINGBEE",
    "email": "mitzi.merrill@springbee.biz",
    "phone": "+1 (881) 520-2254",
    "address": "398 Madison Place, Nutrioso, Florida, 3089",
    "serialNumber": "64167f3c5687",
    "ipAddress": "192.22.6.2",
    "registered": "Thursday, June 8, 2017 6:22 PM"
  }
]

I would like to be able to perform a search on one or more fields for an arbitary substring, such as:

  • Find all documents where the email contains 'bee'
  • Find all documents where ipAddress, SerialNumber, or phone contains '22.'

Recommendations?

Thanks!

2

Even though the book is already a bit older, the section on partial matching from the definitive guide still applies - you might want to to read the whole Search in Depth chapter as I personally find it really useful to understand how search works (which also requires you to understand how data is stored in the inverted index).

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.