Update By Query | Alias

[ankitpandoh (Ankit)]

I am able to add a document to an index say my-main-index having some alias my-alias-index. When I did a search like below, I was able to get the documents.

GET /my-main-index/_search
{
  "query":{
    "match_all": {}
  }
}

or

GET /my-alias-index/_search
{
  "query":{
    "match_all": {}
  }
}

But when I try to do an update_by_query, none of the below is working. I am getting 200 response with no record is being updated.

POST /my-main-index/_update_by_query
{
  "script": {
    "source": "ctx._source['customers.company'] = params.company",
    "lang": "painless",
    "params": {
      "company": "apple"
    }
  },
  "query": {
    "term": {
      "customers.handle": "search-user815"
    }
  }
}

OR 

POST /my-alias-index/_update_by_query
{
  "script": {
    "source": "ctx._source['customers.company'] = params.company",
    "lang": "painless",
    "params": {
      "company": "apple"
    }
  },
  "query": {
    "term": {
      "customers.handle": "search-user815"
    }
  }
}

Could someone please help me identifying the issue?

[dadoonet (David Pilato)]

What's the mapping, specifically for the field customers.handle?

[ankitpandoh (Ankit)]

"handle": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword"
                }
              },
              "norms": false,
              "analyzer": "custom_analyzer"

[dadoonet (David Pilato)]

That's why it's failing. Try on customers.handle.keyword instead:

POST /my-alias-index/_update_by_query
{
  "script": {
    "source": "ctx._source['customers.company'] = params.company",
    "lang": "painless",
    "params": {
      "company": "apple"
    }
  },
  "query": {
    "term": {
      "customers.handle.keyword": "search-user815"
    }
  }
}

[ankitpandoh (Ankit)]

Yeah, it is working now. Thank you so much for pointing it out.
But why does term query not working?

"query": {
    "term": {
      "customers.handle": "search-user815"
    }
  }

[dadoonet (David Pilato)]

Because you are using a text type for this field. Which means that the content is analyzed.
And basically, your "search-user815" is indexed as ["search", "user815"].
When searching with a term query, the searched text is not analyzed so you are trying to compare search-user815 with search or user815, which obviously does not match.

Read more about this from: Text analysis | Elasticsearch Guide [8.9] | Elastic