Wildcard search on raw not_analyzed field

Elastic Stack Elasticsearch
1

I have a dynamic template that sets up not_analyzed raw mappings for all my
string fields.

When I perform a query search like this:
field.raw=KnownValue
it works (has hits).

When I do this:
field.raw=Known?alue
it doesn't return any data (? wildcard doesn't work).

However,
field.raw=*
does return data.

What am I missing? Does it have to do with case-sensitivity?

Here is the dynamic template:
{
"string_fields": {
"mapping": {
"index": "analyzed",
"type": "string",
"fields": {
"raw": {
"index": "not_analyzed",
"ignore_above": 256,
"doc_values": true,
"type": "string"
}
}
},
"match": "*",
"match_mapping_type": "string"
}
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/1a6d1de1-c08a-40f5-96f9-26f7a217b7b7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

First of all you have to use "regexp" filter or query, not "match". If you
mean any character between "Known" and "alue", you have to use dot instead
of question mark. "Known?alue" means "Know" + ("n" or nothing) + "alue".
"Known.alue" means "Known" + any character + "alue".

Like this:

{
"query" : {
"filtered" : {
"query" : {
"match_all" : {}
},
"filter" : {
"bool" : {
"must" : [{
"regexp" : {"your_field_name": "Known.alue"}
}]
}
}
}
},
"from" : 0,
"size" : 20
}

On Tuesday, January 27, 2015 at 1:04:44 AM UTC+2, BradVido wrote:

I have a dynamic template that sets up not_analyzed raw mappings for all
my string fields.

When I perform a query search like this:
field.raw=KnownValue
it works (has hits).

When I do this:
field.raw=Known?alue
it doesn't return any data (? wildcard doesn't work).

However,
field.raw=*
does return data.

What am I missing? Does it have to do with case-sensitivity?

Here is the dynamic template:
{
"string_fields": {
"mapping": {
"index": "analyzed",
"type": "string",
"fields": {
"raw": {
"index": "not_analyzed",
"ignore_above": 256,
"doc_values": true,
"type": "string"
}
}
},
"match": "*",
"match_mapping_type": "string"
}
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/bb8cf127-8a50-44cb-b739-430834400f6b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

3

I am already doing a query text search. I'm expecting the ? to match a
single character. It works on the regular, analyzed, field, just not the
.raw not_analyzed version. That's why i'm confused

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/88040a4f-cfa5-4732-9800-64a176e9a4d4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

4

I need help determining how wildcard matching for non_analyzed fields works.

I have a field message with this mapping defined:
"message" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"doc_values" : true,
"ignore_above" : 256
}
}
}
I've indexed a document that has this data: {"message": "Failed to connect"}

I'm executing a Query String Query, and here are the results:
message.raw:Failed*
No matches

message.raw:failed*
No matches

message.raw:?ailed*
Match found!

Why don't the first two match?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/f55a7497-3bbe-4d32-bf27-89fc3a4533bc%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

5

Update, it seems that the problem is lowercase_expanded_terms defaults to
true.
Setting it to false in my query returned results for the first two queries.

On Monday, January 26, 2015 at 5:04:44 PM UTC-6, BradVido wrote:

I have a dynamic template that sets up not_analyzed raw mappings for all
my string fields.

When I perform a query search like this:
field.raw=KnownValue
it works (has hits).

When I do this:
field.raw=Known?alue
it doesn't return any data (? wildcard doesn't work).

However,
field.raw=*
does return data.

What am I missing? Does it have to do with case-sensitivity?

Here is the dynamic template:
{
"string_fields": {
"mapping": {
"index": "analyzed",
"type": "string",
"fields": {
"raw": {
"index": "not_analyzed",
"ignore_above": 256,
"doc_values": true,
"type": "string"
}
}
},
"match": "*",
"match_mapping_type": "string"
}
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8b081a6d-ad56-497f-851c-abd34b7db916%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.