Subfield search question, please

Elastic Stack Elasticsearch
1

if I index some data like this:

{
"ip" : "1.1.1.1",
"reputation" : {
"score : -3,
"hacker" : {
"name" : "BadBoris",
"city" : "Kiev"
}
}

I can use a query string like 'city:Kiev' to get the record, but can I be
more specific like 'hacker.city:Kiev',
or even better 'reputation.hacker.city:Kiev'? The dot notation does not
seem to work. Is there a way, ideally in Lucene syntax, but if not maybe
DSL?

Many thanks. This forum is a great resource, I hope to provide answers
some day instead of just questions.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Hey,

have you actually tried reputation.hacker.city:Kiev - it should work just
fine in your case.
curl 'localhost:9200/foo/_search?q=reputation.hacker.city:Kiev'

Another way (using the much nicer query dsl syntax) is:
curl 'localhost:9200/foo/_search' -d '{ "query": { "match" : {
"reputation.hacker.city" : "Kiev" } } }'

Definately take a look at the different type of queries before using the
DSL.

--Alex

On Wed, Apr 3, 2013 at 9:18 PM, Tiglath temp6@tiglath.net wrote:

if I index some data like this:

{
"ip" : "1.1.1.1",
"reputation" : {
"score : -3,
"hacker" : {
"name" : "BadBoris",
"city" : "Kiev"
}
}

I can use a query string like 'city:Kiev' to get the record, but can I be
more specific like 'hacker.city:Kiev',
or even better 'reputation.hacker.city:Kiev'? The dot notation does not
seem to work. Is there a way, ideally in Lucene syntax, but if not maybe
DSL?

Many thanks. This forum is a great resource, I hope to provide answers
some day instead of just questions.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Many thanks. You are right. I see now that the reason it did not
work for me is because reputation was a list of hackers, and it only
works if the hacker in the search is at the head of the list.

Then... sorry to try your patience....

Is there a way to search subfields using dot notation when one or more
of the subfields is an array.

For example

"reputation" : [
{
"hacker" : {
"name" : "Beefheart",
"city" : "Riga",
"exploits" : [ "abc", "123" ]
}
}
{
"hacker" {
"name" : "BadIrina",
"city" : "Kiev",
"exploits" : [ "mno", "123" ]
}
}
]

A search for 'reputation.hacker.exploits:123' does not work because
reputation and exploits are arrays.

Thanks

On Apr 4, 3:12 am, Alexander Reelsen a...@spinscale.de wrote:

Hey,

have you actually tried reputation.hacker.city:Kiev - it should work just
fine in your case.
curl 'localhost:9200/foo/_search?q=reputation.hacker.city:Kiev'

Another way (using the much nicer query dsl syntax) is:
curl 'localhost:9200/foo/_search' -d '{ "query": { "match" : {
"reputation.hacker.city" : "Kiev" } } }'

Definately take a look at the different type of queries before using the
DSL.

--Alex

On Wed, Apr 3, 2013 at 9:18 PM, Tiglath te...@tiglath.net wrote:

if I index some data like this:

{
"ip" : "1.1.1.1",
"reputation" : {
"score : -3,
"hacker" : {
"name" : "BadBoris",
"city" : "Kiev"
}
}

I can use a query string like 'city:Kiev' to get the record, but can I be
more specific like 'hacker.city:Kiev',
or even better 'reputation.hacker.city:Kiev'? The dot notation does not
seem to work. Is there a way, ideally in Lucene syntax, but if not maybe
DSL?

Many thanks. This forum is a great resource, I hope to provide answers
some day instead of just questions.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visithttps://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

4

Hey,

not sure where your problem is, the search works for me

curl -X PUT localhost:9200/foo/bar/1 -d '{
"reputation" : [
{
"hacker" : {
"name" : "Beefheart",
"city" : "Riga",
"exploits" : [ "abc", "123" ]
}
},
{
"hacker" : {
"name" : "BadIrina",
"city" : "Kiev",
"exploits" : [ "mno", "123" ]
}
}
]
}
'

curl 'localhost:9200/foo/_search?q=reputation.hacker.exploits:123'

Searching either for mno, abc or 123 returns the document as expected.
Maybe you fiddled around with your mapping while trying out stuff. It might
make sense to delete the whole index and reindex all your data in order to
be sure. More about mapping:

Also it might make sense, if you read about nested documents. If you index
data above, you can search for reputation.hacker.city=Riga and
reputation.hacker.name=BadIrina and you would get back this document.
Nested documents behave correct in this case. Check it out at

Also note, that your have to use the query DSL really and cannot use the
simple search (using the lucene query syntax) as above when you use nested
documents.

On Tue, Apr 9, 2013 at 1:44 AM, Tiglath temp6@tiglath.net wrote:

Many thanks. You are right. I see now that the reason it did not
work for me is because reputation was a list of hackers, and it only
works if the hacker in the search is at the head of the list.

Then... sorry to try your patience....

Is there a way to search subfields using dot notation when one or more
of the subfields is an array.

For example

"reputation" : [
{
"hacker" : {
"name" : "Beefheart",
"city" : "Riga",
"exploits" : [ "abc", "123" ]
}
}
{
"hacker" {
"name" : "BadIrina",
"city" : "Kiev",
"exploits" : [ "mno", "123" ]
}
}
]

A search for 'reputation.hacker.exploits:123' does not work because
reputation and exploits are arrays.

Thanks

On Apr 4, 3:12 am, Alexander Reelsen a...@spinscale.de wrote:

Hey,

have you actually tried reputation.hacker.city:Kiev - it should work just
fine in your case.
curl 'localhost:9200/foo/_search?q=reputation.hacker.city:Kiev'

Another way (using the much nicer query dsl syntax) is:
curl 'localhost:9200/foo/_search' -d '{ "query": { "match" : {
"reputation.hacker.city" : "Kiev" } } }'

Definately take a look at the different type of queries before using the
DSL.

--Alex

On Wed, Apr 3, 2013 at 9:18 PM, Tiglath te...@tiglath.net wrote:

if I index some data like this:

{
"ip" : "1.1.1.1",
"reputation" : {
"score : -3,
"hacker" : {
"name" : "BadBoris",
"city" : "Kiev"
}
}

I can use a query string like 'city:Kiev' to get the record, but can I
be
more specific like 'hacker.city:Kiev',
or even better 'reputation.hacker.city:Kiev'? The dot notation does
not
seem to work. Is there a way, ideally in Lucene syntax, but if not
maybe
DSL?

Many thanks. This forum is a great resource, I hope to provide answers
some day instead of just questions.

--
You received this message because you are subscribed to the Google
Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visithttps://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.