Elasticsearch query_string search complex keyword by its terms

Question

Now, I know that keyword is not supposed to comprise unstructured text, but let's say that for some reason it just so happened that such text was written into keyword field. When searching such documents using match or term queries, the document is not found, but when searched using query_string the document is found by a partial match(a "term" inside keyword). I don't understand how this is possible when the documentation for Elasticsearch clearly states that keyword is inverse-indexed as is, without terms tokenization. Example: My index mapping:

PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "full_text": {
          "type":  "text" 
        },
        "exact_value": {
          "type":  "keyword" 
        }
      }
    }
  }
}

Then I put a document in:

PUT my_index/my_type/2
{
  "full_text":   "full text search", 
  "exact_value": "i want to find this trololo!"  
}

And imagine my surprise when I get a document by keyword term, not a full match:

GET my_index/my_type/_search
{
  "query": {
    "match": {
      "exact_value": "trololo" 
    }
  }
}

- no result;

GET my_index/my_type/_search
{
  "query": {
    "term": {
      "exact_value": "trololo" 
    }
  }
}

- no result;

POST my_index/_search
{"query":{"query_string":{"query":"trololo"}}}

- my document is returned(!):

       "hits": {
      "total": 1,
      "max_score": 0.27233246,
      "hits": [
         {
            "_index": "my_index",
            "_type": "my_type",
            "_id": "2",
            "_score": 0.27233246,
            "_source": {
               "full_text": "full text search",
               "exact_value": "i want to find this trololo!"
            }
         }
      ]
   }

user3775217 · Accepted Answer · 2017-07-21 09:25:43Z

2

when you do a query_string query on elastic like below

POST index/_search
{
    "query": {
        "query_string": {
            "query": "trololo"
        }
    }
}

This actually do a search on _all field which if you don't mention get analyzed by standard analyzer in elastic.

If you specify the field in query like the following you won't get records for keyword field.

POST my_index/_search
{
  "query": {
    "query_string": {
      "default_field": "exact_value", 
      "query": "field"
    }
  }
}

answered Jul 21, 2017 at 9:25

user3775217

4,8231 gold badge26 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

yuranos Over a year ago

that makes perfect sense. Sure, I'm aware of _all field, I just didn't have enough hands-on experience since we started investigating Elastic stack just recently and I didn't manage to put it all together. Thanks!

Collectives™ on Stack Overflow

Elasticsearch query_string search complex keyword by its terms

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related