elasticsearch multi field query is not working as expected

Question

I've been facing some issues with multi field elasticsearch query. I am trying to query all the documents which matches the field called func_name to two hard coded strings, even though my index has documents with both these function names, but the query result is always fetching only one func_name. So far I have tried following queries.

1) Following returns only one function match, even though the documents have another function as well

GET /_search
{
  "query": {
    "multi_match": {
      "query": "FEM_DS_GetTunerStatusInfo MDM_TunerStatusPrint",
      "operator": "OR",
      "fields": [
        "func_name"
      ]
    }
  }
}

2) following intermittently gives me both the functions.

GET /_search
{
    "query": {
        "match": {
            "func_name": {      
                "query":    "MDM_TunerStatusPrint FEM_DS_GetTunerStatusInfo",
                "operator": "or"
            }
        }
    }
}

3) Following returns only one function match, even though the documents have another function as well

{
  "query": {
    "bool": {
      "should": [
                  { "match": { "func_name": "FEM_DS_GetTunerStatusInfo" }},
                  { "match": { "func_name": "MDM_TunerStatusPrint"   }}
      ]
    }
  }
}

Any help is much appreciated.

Thanks for your reply. Lets assume that I have following kind of documents in my elasticsearch. I want my search to return first two documents out of all as they matches my func_name.

{
    "_index": "diag-178999",
    "_source": {
      "severity": "MIL",
      "t_id": "03468500",
      "p_id": "000007c6",
      "func_name": "MDM_TunerStatusPrint",
      "timestamp": "2017-06-01T02:04:51.000Z"
    }
  },
  {
    "_index": "diag-344563",
    "_source": {
      "t_id": "03468500",
      "p_id": "000007c6",
      "func_name": "FEM_DS_GetTunerStatusInfo",
      "timestamp": "2017-07-20T02:04:51.000Z"
    }
  },
  {
    "_index": "diag-101010",
    "_source": {
      "severity": "MIL",
      "t_id": "03468500",
      "p_id": "000007c6",
      "func_name": "some_func",
      "timestamp": "2017-09-15T02:04:51.000Z"
    }

Answer 1

The "two best ways" to request your ES is to filter by terms on a particular field or to aggregate your queries so that you can rename the field, apply multiple rules, and give a more understandable format to your response

See : https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html and the other doc page is here, very useful : https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html

In your case, you should do :

    {
      "from" : 0, "size" : 2,
      "query": {
          "filter": {
            "bool": {
              "must": {
                "term": {
                  "func_name" : "FEM_DS_GetTunerStatusInfo OR MDM_TunerStatusPrint",
                }
              }
            }
          }
    }
}

OR 
    	"aggs": {
               "aggregationName": {
                     "terms": {
    		     "func_name" : "FEM_DS_GetTunerStatusInfo OR MDM_TunerStatusPrint"
    		   }
              }
            }
        }

The aggregation at the end is just here to show you how to do the same thing as your query filter. Let me know if it's working :)

Best regards

Answer 2

As I understand, you should use filtered query to match any document with one of the values of func_name mentioned above:

{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "terms": {
                "func_name": [
                  "FEM_DS_GetTunerStatusInfo",
                  "MDM_TunerStatusPrint"
                ]
              }
            }
          ]
        }
      }
    }
  }
}

See: Filtered Query, Temrs Query

UPDATE in ES 5.0:

{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "func_name": [
              "FEM_DS_GetTunerStatusInfo",
              "MDM_TunerStatusPrint"
            ]
          }
        }
      ]
    }
  }
}

See: this answer