AWS ElasticSearch - Match Query Not Working

Question

I have deployed an elastic search instance through AWS` managed ElasticSearch service (version 7.4.2) and having trouble getting "match" queries working. I am playing around with the sample flights dataset and running the following query:

Data:

[
    {
        "FlightNum": "HX0WBLI",
        "DestCountry": "IT",
        "OriginWeather": "Damaging Wind",
        "OriginCityName": "Chitose / Tomakomai",
        "AvgTicketPrice": 988.8975638746068,
        "DistanceMiles": 5650.511340218511,
        "FlightDelay": false,
        "DestWeather": "Sunny",
        "Dest": "Verona Villafranca Airport"
    },
    {
        "FlightNum": "VG7H7U4",
        "DestCountry": "IT",
        "OriginWeather": "Cloudy",
        "OriginCityName": "Milan",
        "AvgTicketPrice": 223.66801608639728,
        "DistanceMiles": 78.45850223819446,
        "FlightDelay": false,
        "DestWeather": "Sunny",
        "Dest": "Verona Villafranca Airport"
    },
    {
        "FlightNum": "B3CVVO3",
        "DestCountry": "IT",
        "OriginWeather": "Cloudy",
        "OriginCityName": "Sydney",
        "AvgTicketPrice": 360.41688271717148,
        "DistanceMiles": 10207.122317757072,
        "FlightDelay": false,
        "DestWeather": "Rain",
        "Dest": "Verona Villafranca Airport"
    }
]

Query:

POST kibana_sample_data_flights/_search
{
   "query": {
       "match":{
           "Dest": "Verona"
       }
    }
}

I know there are items with that should partially match but I get an empty result set back. Specifying the full value "Verona Villafranca Airport" yields some results. Is something needs to be enabled to get the query above working?

Also the same query works as expected against a local instance (deployed through docker).

Thanks for your help!

Answer 1

As you have not provided your mapping and looking at your question, it seems in your mapping, Dest field is defined as keyword which isn't analyzed. hence storing Verona Villafranca Airport would be stored as it is.

When you use the match query which is analyzed means it uses the same analyzer used to index the field, which would be keyword in this case, hence searching for Verona Villafranca Airport returns the result as this token present in the inverted index, while searching for Verona will not match any token, hence you don't get any result.

Solution: if you want the case insensitive search and want to search on Verona or airport, then you need to define this Dest field as text and Elasticsearch uses the standard analyzer by default which would automatically lowercase and split the text on whitespace, which would enable above search criteria.

And later on you can use the same match query, which you are using and it would work as explained in docs.

Note on match query from doc

Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.

Tokens generated by standard analyzer

POST /_analyze
{
    "text" : "Verona Villafranca Airport",
    "analyzer" : "standard"
}

{
    "tokens": [
        {
            "token": "verona",
            "start_offset": 0,
            "end_offset": 6,
            "type": "<ALPHANUM>",
            "position": 0
        },
        {
            "token": "villafranca",
            "start_offset": 7,
            "end_offset": 18,
            "type": "<ALPHANUM>",
            "position": 1
        },
        {
            "token": "airport",
            "start_offset": 19,
            "end_offset": 26,
            "type": "<ALPHANUM>",
            "position": 2
        }
    ]
}

Tokens generated by keyword

POST /_analyze

{
    "text" : "Verona Villafranca Airport",
    "analyzer" : "keyword"
}

{
    "tokens": [
        {
            "token": "Verona Villafranca Airport",
            "start_offset": 0,
            "end_offset": 26,
            "type": "word",
            "position": 0
        }
    ]
}