Elasticsearch query yeilds no results

Ranger Published at Dev

Ranger

I'm new to elasticsearch and having some problems with a query. I can't seem to perform a query based on my "userid" field. Here is the mapping for my index.

{
    "testindex" : {
       "mappings" : {
          "properties" : {
             "timestamp" : {
                "type" : "date"
             },
             "content" : {
                "fields" : {
                   "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                   }
                },
                "type" : "text"
             },
             "userid" : {
                "fields" : {
                   "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                   }
                },
                "type" : "text"
             }
          }
       },
       "aliases" : {},
       "settings" : {
          "index" : {
             "creation_date" : "1605323501230",
             "number_of_shards" : "1",
             "number_of_replicas" : "1",
             "version" : {
                "created" : "7090399"
             },
             "uuid" : "<removed>",
             "provided_name" : "testindex"
          }
       }
    }
 }

Here is a document in my cluster when retrieved by the document id.

 {
    "_index":"testindex",
    "_type":"_doc",
    "_id":"d757422a-acf4-4ab0-89f5-bb79b2e2c699",
    "_version":1,
    "_seq_no":1,
    "_primary_term":1,
    "found":True,
    "_source":{
       "userid":"9fe3ba41-780f-448d-8c99-c0440a7ba3f0",
       "content":"testing, testing 12",
       "timestamp":"2020-11-15T05:33:06.615631+00:00"
    }
 }

Here is a query I'm trying based on the userid field.

{
   "query":{
      "bool":{
         "should":{
            "term":{
               "userid":"9fe3ba41-780f-448d-8c99-c0440a7ba3f0"
            }
         }
      }
   }
}

I do not get any results, and the explain output is not helpful.

{
   "_index":"testindex",
   "_type":"_doc",
   "_id":"d757422a-acf4-4ab0-89f5-bb79b2e2c699",
   "matched":False,
   "explanation":{
      "value":0.0,
      "description":"no matching term",
      "details":[
         
      ]
   }
}

What am I doing wrong?

Bhavya

The term query is looking for exact matches, for that you need to use keyword field

Search Query:

{
   "query":{
      "bool":{
         "should":{
            "term":{
               "userid.keyword":"9fe3ba41-780f-448d-8c99-c0440a7ba3f0"
            }
         }
      }
   }
}

Search Result:

"hits": [
      {
        "_index": "64845089",
        "_type": "_doc",
        "_id": "1",
        "_score": 0.2876821,
        "_source": {
          "userid": "9fe3ba41-780f-448d-8c99-c0440a7ba3f0",
          "content": "testing, testing 12",
          "timestamp": "2020-11-15T05:33:06.615631+00:00"
        }
      }
    ]

Search Query using Match Query:

The userid field is most probably indexed with the standard analyzer which will generate the following tokens:

{
  "tokens": [
    {
      "token": "9fe3ba41",
      "start_offset": 0,
      "end_offset": 8,
      "type": "<ALPHANUM>",
      "position": 0
    },
    {
      "token": "780f",
      "start_offset": 9,
      "end_offset": 13,
      "type": "<ALPHANUM>",
      "position": 1
    },
    {
      "token": "448d",
      "start_offset": 14,
      "end_offset": 18,
      "type": "<ALPHANUM>",
      "position": 2
    },
    {
      "token": "8c99",
      "start_offset": 19,
      "end_offset": 23,
      "type": "<ALPHANUM>",
      "position": 3
    },
    {
      "token": "c0440a7ba3f0",
      "start_offset": 24,
      "end_offset": 36,
      "type": "<ALPHANUM>",
      "position": 4
    }
  ]
}

So either you can use the above term query for an exact match or you can use the match query as shown below

 {
       "query":{
          "bool":{
             "should":{
                "match":{
                   "userid":"9fe3ba41-780f-448d-8c99-c0440a7ba3f0"
                }
             }
          }
       }
    }

Collected from the Internet

Please contact [email protected] to delete if infringement.