CODEWITHSUNDEEP
elasticsearch
Kaito Higa
Kaito Higa

Reputation: 31

I search for all fields using Elasticsearch, do you know which field matched?

I search for all fields using Elasticsearch, do you know which field matched?

PUT my_index/user/1 
{
  "first_name":    "John",
  "last_name":     "Smith",
  "date_of_birth": "1970-10-24"
}

GET my_index/_search
{
  "query": {
    "match": {
      "_all": "john 1970"
    }
  }
}

In the above example, "john 1970" is searched for all fields. Since the put document matches "first_name" and "date_of_birth", it returns as a result.

How do I know that it matches "first_name" and "date_of_birth"?

Upvotes: 3

Views: 74

Answers (1)

Val
Val

Reputation: 217474

The thing is that _all is a field into which all values from all other fields are copied at indexing time. Concretely, when you index your document, what ES conceptually sees is this (though the source is not modified to contain _all and _all itself is not stored, just indexed):

{
  "first_name":    "John",
  "last_name":     "Smith",
  "date_of_birth": "1970-10-24",
  "_all": "john smith 1970 10 24"
}

So if you match against _all then the only field that can match is _all itself, there's no way to "reverse-engineer" which field contained which matching value solely based on _all.

What you can do, however, is to use another feature called highlighting. Since the _all field is not stored it cannot be highlighted but the other fields can, so you can highlight which original fields match which values:

{
  "query": {
    "match": {
      "_all": "john 1970"
    }
  },
  "highlight": {
    "fields": {
      "*": {
        "require_field_match": false
      }
    }
  }
}

In the response, you'll see something like this which shows that first_name matches the query.

"highlight": {
  "first_name": [
    "<em>John</em>"
  ]
}

Upvotes: 2

Related Questions