Testing Match query to fail, but returns docs, although they do not match

Elastic Stack Elasticsearch
1

Hi Team, first post here and hope you guys can help me stop going round and round! :wink:

It's java code using elastic libs/methods

I'm trying to look for a string in a field - eg, ":21:test123blah" and expecting it to fail and hit my error messages, but instead I get some docs back, although none of them have my search string.

If, however, I search for just "test123blah" then it correctly returns the error message I've created indicating no matched records.

The JAVA code I have is:

matchquerybuilder test = querybuilders
                                              .matchQuery ("fieldarea", ":21:"+testref)
BoolQueryBuilder matchQ = QueryBuilders.boolQuery();
matchQ.must(test);

I then send it to matchQ to a searchsourcebuilder.query and set that as the searchrequest.source - all of which is oretty standard I think... The query is with why I can't seem to use the ":21:" as part of the query correctly.

PS, also tried to double escape (//) the ":" chars, still to no avail

Thanks a bill for even looking at this!

Ta,
T

2

In order to understand what happens here, you need to understand how a string like :21:test.. is depicted into single tokens and how it is stored in the inverted index. This is massively different like a SQL database.

A good place to start is the Analyze API. The Getting Started chapter of the definitive guide to Elasticsearch can also help a lot: Getting Started | Elasticsearch: The Definitive Guide [2.x] | Elastic

3

Thanks Spinscale,

I'll start wading through but you got any pointers as time is against me - ie, I assume it's down to the ":" characters as they are a special character for searching, right? Or is it in effect, returning any hits that has ":", "21" and ":" in the "message" field aswell as the "testref" value?

Ta,
T

4

Ok, sussed it out myself using another query builder

MatchPhraseQueryBuilder test = QueryBuilders
.matchPhraseQuery ("fieldarea",":21:"+testref);

This seems like it does the trick if you put in a valid "testref" which returns you docs and and a garbage "testref" returning nought.

Ta,
T

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.