Wrong query_string search results on ES 5.3

[Zsolt]

I'm working on migrating from 1.7 to 5.3 and I must be missing something because my query_string query doesn't behave as it did in 1.7.

My simple query:

POST /scanning-v5-2/history/_search
{
   "from": 0,
   "size": 10,   
   "query": {
      "query_string": {
         "query": "fname.fname_search:test"
      }
   }
}

The query returns both documents instead of only one.

PUT /scanning-v5-2
{
   "settings": {
      "index": {
         "number_of_shards": "3",
         "number_of_replicas": "0",
         "analysis": {
            "normalizer": {
               "ci_normalizer": {
                  "type": "custom",
                  "filter": [
                     "lowercase"
                  ]
               }
            },
            "filter": {
               "ngram": {
                  "type": "nGram",
                  "min_gram": "2",
                  "max_gram": "15"
               }
            },
            "analyzer": {
               "my_nGram_analyzer": {
                  "filter": [
                     "lowercase",
                     "ngram"
                  ],
                  "tokenizer": "keyword"
               }
            }
         }
      }
   },
   "mappings": {
      "history": {
         "properties": {
            "fname": {
               "normalizer": "ci_normalizer",
               "type": "keyword",
               "fields": {
                  "fname_search": {
                     "analyzer": "my_nGram_analyzer",
                     "type": "text"
                  }
               }
            }
         }
      }
   }
}

PUT scanning-v5-2/history/1
{
    "fname": "Test this file.pdf"
}
PUT scanning-v5-2/history/2
{
    "fname": "What a structured file.pdf"
}

[spinscale (Alexander Reelsen)]

Hey,

you are using the ngram analyzer also for querying, so your phrase will be depicted into terms like st - use the analyze API to find out. That term however, also shows up in the other document. You could change the analyzer used in the query string query back to standard (as an example, not as a permanent solution otherwise you ngrams would be useless) and see the correct document returned again.

I dont know on top of my head, what has changed from 1.7 to 5.3 that would cause this... has been a long time.

--Alex

[Zsolt]

@spinscale In 1.7 I had "index_analyzer" that I migrated to "analyzer" and I didn't realize that it actually changed my search analyzer to ngram too. Thanks for your help.