CODEWITHSUNDEEP
elasticsearch
Paul
Paul

Reputation: 1400

Empty output when querying a specific field

I would like to get data from my elasticSearch index.

So I have the following index:

With Node, If I do a:

const hits = await elasticClient.search({
    index: esIndex,
    size: 999,
    sort: 'ts:desc',
    body: {
      query: {
        bool: {
          must: [
            {
              term: {
                userId: '56',
              },
            }
          ],
        },
      },
    },
  });

it will returns:

[
    {
        "_index": "events_rc",
        "_type": "_doc",
        "_id": "tf-szm0B_tB6kax4xmnr",
        "_score": null,
        "_source": {
            "userId": "56",
            "eventName": "synchronizationStart",
            "ts": 1571130486383
        }
    },
    {
        "_index": "events_rc",
        "_type": "_doc",
        "_id": "tP-szm0B_tB6kax4xmnr",
        "_score": null,
        "_source": {
            "userId": "56",
            "eventName": "showSynchronizationModal",
            "ts": 1571130447209
        }
    }
]

but If I do the following query:

const hits = await elasticClient.search({
    index: esIndex,
    size: 999,
    sort: 'ts:desc',
    body: {
      query: {
        bool: {
          must: [
            {
              term: {
                eventName: 'synchronizationStart',
              },
            }
          ],
        },
      },
    },
});

it will returns an empty array...

I would like to know why it can found matches with the userId but not with eventName ?

The mapping seems to be identicals for the 2 fields

"eventName": {
  "type": "text",
  "fields": {
  "keyword": {
    "type": "keyword",
    "ignore_above": 256
  }
}

"userId": {
  "type": "text",
  "fields": {
  "keyword": {
    "type": "keyword",
    "ignore_above": 256
  }
}

thx

Upvotes: 0

Views: 31

Answers (2)

Assael Azran
Assael Azran

Reputation: 2993

eventName is of type text. you should use match and not term.

Avoid using the term query for text fields.

Taken from Here

If you will use eventName.keyword then you will have to add a custom normalizer to your field, otherwise you will have to search the exact term.

Change 

    const hits = await elasticClient.search({
    index: esIndex,
    size: 999,
    sort: 'ts:desc',
    body: {
      query: {
        bool: {
          must: [
            {
              term: {
                eventName: 'synchronizationStart',
              },
            }
          ],
        },
      },
    },
});

To:

const hits = await elasticClient.search({
index: esIndex,
size: 999,
sort: 'ts:desc',
body: {
  query: {
    bool: {
      must: [
        {
          match: {
            eventName: 'synchronizationStart',
          },
        }
      ],
    },
  },
},

});

Upvotes: 1

Val
Val

Reputation: 217424

You need to query on the eventName.keyword field and it will work:

const hits = await elasticClient.search({
    index: esIndex,
    size: 999,
    sort: 'ts:desc',
    body: {
      query: {
        bool: {
          must: [
            {
              term: {
                'eventName.keyword': 'synchronizationStart',
              },
            }
          ],
        },
      },
    },
});

Upvotes: 1

Related Questions