CODEWITHSUNDEEP
elasticsearch
Tim
Tim

Reputation: 485

How does "query_string" work in Elasticsearch?

I have a index in ES 5 with the following mappings

{
  "test-log": {
    "mappings": {
      "record": {
        "properties": {
          "content": {
            "type": "text"
          },
          "level": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

And I index such a document

POST test-log/record
{
  "content":"this is about java and mysql",
  "level":"info"
}

And using the following DSL I can get data

GET test-log/_search
{
  "query": {
    "query_string": {
      "query": "info error"
    }
  }
}

Then I upgrade ES to 7.4 

{
  "test-log" : {
    "mappings" : {
      "properties" : {
        "content" : {
          "type" : "text"
        },
        "level" : {
          "type" : "keyword"
        }
      }
    }
  }
}

However I got empty result.

So how does query_string work in ES 7 ?

What is different between ES 5 and 7 ?

Upvotes: 0

Views: 157

Answers (2)

Tim
Tim

Reputation: 485

There is a breaking change in ES 6.

https://www.elastic.co/guide/en/elasticsearch/reference/6.8/breaking-changes-6.0.html#_the_literal__all_literal_meta_field_is_now_disabled_by_default

In ES 5, default_field defaults to _all, and _all is a special catch-all field which concatenates the values of all of the other fields into one big string.

In ES 7, default_field has a default value of *, The * value extracts all fields that are eligible to term queries and filters the metadata fields. All extracted fields are then combined to build a query if no prefix is specified.They are combined, but NOT concatenated

Upvotes: 0

Björn Marschollek
Björn Marschollek

Reputation: 10009

According to the documentation, you probably want "query": "info OR error".

Upvotes: 1

Related Questions