Subfield query not returning any data

Elastic Stack Elasticsearch
1

New to Elasticsearch, so please bear with me if this is a simple question that I should know. I have an index with fairly simple documents. When I try to query against anything in AppDataDict, though, I don't ever get a return. What am I doing wrong? Document, Mapping, Query, and return are below.

Document:

{
	"_index": "reporting",
	"_type": "_doc",
	"_id": "XHw3QYIBF21eEEgTi_Aa",
	"_score": 4.6823745,
	"_source": {
		"PageSize": 0,
		"Page": 0,
		"AppDataDict": {
			"UserName": "Presley, Elvis",
			"Location1": "R",
			"Location2": "POPLAR",
			"DeviceDescription": null,
			"DeviceType": null,
			"DeviceIP": null
		},
		"EventType": 1,
		"EventDescription": "User logged out",
		"Success": true,
		"EventDate": "2022-06-20T13:59:14.893",
		"Id": 191
	}
}

Mapping:

{
    "reporting": {
        "mappings": {
            "properties": {
                "AppDataDict": {
                    "type": "nested",
                    "properties": {
                        "DeviceDescription": {
                            "type": "text"
                        },
                        "DeviceType": {
                            "type": "text"
                        },
                        "FacilityName": {
                            "type": "text"
                        },
                        "Location1": {
                            "type": "text"
                        },
                        "Location2": {
                            "type": "text"
                        },
                        "UserName": {
                            "type": "text"
                        }
                    }
                },
                "EventDate": {
                    "type": "date"
                },
                "EventDescription": {
                    "type": "text"
                },
                "EventType": {
                    "type": "integer"
                },
                "Id": {
                    "type": "long"
                },
                "Page": {
                    "type": "integer"
                },
                "PageSize": {
                    "type": "integer"
                },
                "Success": {
                    "type": "boolean"
                }
            }
        }
    }
}

Query:

{
    "query": {
        "bool": {
            "must": [
                {"match": {"AppDataDict.Location2": "POPLAR"}}
            ]
        }
    }
}

Result:

{
    "took": 3,
    "timed_out": false,
    "_shards": {
        "total": 9,
        "successful": 9,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 0,
            "relation": "eq"
        },
        "max_score": null,
        "hits": []
    }
}
2

Hi @Baerswords

The "nested" type has a special query type. The Nested query.

Try:

{
  "query": {
    "nested": {
      "path": "AppDataDict",
      "query": {
        "match": {
          "AppDataDict.Location2": "POPLAR"
        }
      }
    }
  }
}
3

Tried that and got the error below. Is my mapping off maybe?

"caused_by": {
	"type": "illegal_state_exception",
	"reason": "[nested] failed to find nested object under path [AppDataDict]"
}

Also, I've seen numerous posts where people read subfields with a simple match query like I initially had. I need to be able to put it together with other regular match queries in a bool return. This format will make that impossible, won't it?

4

As AppDataDict is a simple object and not an array of objects you do not need the nested mapping. Remove this and you no longer need to use nested queries.

1 Like
5

That's exactly what I needed. I took out the nested path and everything works well. TY!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.