CODEWITHSUNDEEP
elasticsearch
verisimilitude
verisimilitude

Reputation: 5108

Multi-level nesting in elastic search

I have the below structure (small part of a very large elastic-search document)

sample: {
   {
       "md5sum":"4002cbda13066720513d1c9d55dba809",
       "id":1,
       "sha256sum":"1c6e77ec49413bf7043af2058f147fb147c4ee741fb478872f072d063f2338c5",
       "sha1sum":"ba1e6e9a849fb4e13e92b33d023d40a0f105f908",
       "created_at":"2016-02-02T14:25:19+00:00",
       "updated_at":"2016-02-11T20:43:22+00:00",
       "file_size":188416,
       "type":{
          "name":"EXE"
       },
       "tags":[

       ],
       "sampleSources":[
          {
             "filename":"4002cbda13066720513d1c9d55dba809",
             "source":{
                "name":"default"
             }
          },
         {
             "filename":"4002cbda13066720332513d1c9d55dba809",
             "source":{
                "name":"default"
             }
          }
       ]

    }
}

The filter I would like to use is to find by the 'name' contained within sample.sampleSources.source using elastic search.

I tried the below queries

curl -XGET "http://localhost:9200/app/sample/_search?pretty" -d {query} where, {query} is

{
   "query":{
      "nested":{
         "path":"sample.sampleSources",
         "query":{
            "nested":{
               "path":"sample.sampleSources.source",
               "query":{
                  "match":{
                     "sample.sampleSources.source.name":"default"
                  }
               }
            }
         }
      }
   }
}

However, it is not returning me any results. I have certain cases in my document where the nesting is more deeper than this. Can someone please guide me as to how should I formulate this query so that it works for all cases?

EDIT 1 Mappings: 

{
   "app":{
      "mappings":{
         "sample":{

               "sampleSources":{
                  "type":"nested",
                  "properties":{
                     "filename":{
                        "type":"string"
                     },
                     "source":{
                        "type":"nested",
                        "properties":{
                           "name":{
                              "type":"string"
                           }
                        }
                     }
                  }
               }

}

EDIT 2 The solution posted by Waldemar Neto below works well for match query but not for a wild-card or neither for a regexp

Can you please guide? I need the wild-card and the regexp queries to be working for this.

Upvotes: 4

Views: 3824

Answers (1)

Waldemar Neto
Waldemar Neto

Reputation: 886

i tried here using your examples and works fine. Take a look in my data. mapping:

PUT /app
{
      "mappings": {
         "sample": {
            "properties": {
               "sampleSources": {
                  "type": "nested",
                  "properties": {
                     "source": {
                        "type": "nested"
                     }
                  }
               }
            }
         }

   }
}

indexed data

POST /app/sample
{
   "md5sum": "4002cbda13066720513d1c9d55dba809",
   "id": 1,
   "sha256sum": "1c6e77ec49413bf7043af2058f147fb147c4ee741fb478872f072d063f2338c5",
   "sha1sum": "ba1e6e9a849fb4e13e92b33d023d40a0f105f908",
   "created_at": "2016-02-02T14:25:19+00:00",
   "updated_at": "2016-02-11T20:43:22+00:00",
   "file_size": 188416,
   "type": {
      "name": "EXE"
   },
   "tags": [],
   "sampleSources": [
      {
         "filename": "4002cbda13066720513d1c9d55dba809",
         "source": {
            "name": "default"
         }
      },
      {
         "filename": "4002cbda13066720332513d1c9d55dba809",
         "source": {
            "name": "default"
         }
      }
   ]
}

Search query

GET /app/sample/_search
{
   "query": {
      "nested": {
         "path": "sampleSources.source",
         "query": {
             "match": {
                "sampleSources.source.name": "default"
             }
         }
      }
   }
}

Example using wildcard

GET /app/sample/_search
{
   "query": {
      "nested": {
         "path": "sampleSources.source",
         "query": {
             "wildcard": {
                "sampleSources.source.name": {
                   "value": "*aul*"
                }
             }
         }
      }
   }
}

The only thing that I saw some difference was in the path, you don't need to set the sample (type) in the nested path, only the inner objets. Test and give me a feedback.

Upvotes: 3

Related Questions