CODEWITHSUNDEEP
elasticsearch
jpaa89
jpaa89

Reputation: 7

Elasticsearch 6.3 query with space in a keyword field and not returning all documents

I have the fallowing part of a mapping:

"name": {
    "store": "true",
    "type": "keyword"
}

and this query:

{
    "query":{
        "query_string":{
            "query":"+(name:John Doe)",
            "fields":[

            ]
        }
    },
    "aggregations":{

        "name":{
            "terms":{
                "field":"name",
                "size":10
            }
        }
    }
}

The query should return over 100 results however it only returns a few. If I add quotes to John Doe like this: \"John Doe\" then it returns all the desired results.

I'm wondering why this happens. Isn't enough that the field is mapped as keyword so that John Doe is analyzed as a whole, and no quotes should be added? Also, why would it return less items without quotes?

Note: In ES 1.4 the same query seems to work fine (although is not the same data to be honest, and it uses facets instead of aggregations).

Upvotes: 0

Views: 1227

Answers (1)

Alexey Prudnikov
Alexey Prudnikov

Reputation: 1123

The documentation for query string query clearly states:

If the field is a keyword field the analyzer will create a single term ...

So you don't need to add quotes to your search string. Instead, you need to write your query correctly. Currently your query try to find the term John in field name, and term Doe in all other fields! So you must rewrite your query in one of the following ways:

  1. Add parentheses to your search term so the query parser can "understand" that all words must be found in name field:

    {
    "query": {
        "query_string": {
            "query": "+(name:(John Doe))",
            "fields": [

            ]
        }
    },
    "aggregations": {
        "name": {
            "terms": {
                "field": "name",
                "size": 10
            }
        }
    }
}

  2. Specify field name in fields array rather than in query string:

    {
    "query": {
        "query_string": {
            "query": "+(John Doe)",
            "fields": [
                "name"
            ]
        }
    },
    "aggregations": {
        "name": {
            "terms": {
                "field": "name",
                "size": 10
            }
        }
    }
}

Upvotes: 1

Related Questions