63

I have the following Elastic Search query with only a term filter. My query is much more complex but I am just trying to show the issue here.

{
    "filter": {
            "term": {
                    "field": "update-time"
                }
        }
}

When I pass in a hyphenated value to the filter, I get zero results back. But if I try without an unhyphenated value I get results back. I am not sure if the hyphen is an issue here but my scenario makes me believe so.

Is there a way to escape the hyphen so the filter would return results? I have tried escaping the hyphen with a back slash which I read from the Lucene forums but that didn't help.

Also, if I pass in a GUID value into this field which is hyphenated and surrounded by curly braces, something like - {ASD23-34SD-DFE1-42FWW}, would I need to lower case the alphabet characters and would I need to escape the curly braces too?

Thanks

2
  • 2
    I wasted a day only to figure out that the problem of not getting any documents back was not due to a bad query but due to a hyphen in my test example... Commented Aug 27, 2015 at 9:07
  • I wasted two days....
    – Brah0um
    Commented Jun 12, 2019 at 20:12

3 Answers 3

94

I would guess that your field is analyzed, which is default setting for string fields in elasticsearch. As a result, when it indexed it's not indexed as one term "update-time" but instead as 2 terms: "update" and "time". That's why your term search cannot find this term. If your field will always contain values that will have to be matched completely as is, it would be the best to define such field in mapping as not analyzed. You can do it by recreating the index with new mapping:

curl -XPUT http://localhost:9200/your-index -d '{
    "mappings" : {
        "your-type" : {
            "properties" : {
                "field" : { "type": "string", "index" : "not_analyzed" }
            }
        }
    }
}'

curl -XPUT  http://localhost:9200/your-index/your-type/1 -d '{
    "field" : "update-time"
}'

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "filter": {
        "term": {
                "field": "update-time"
        }
    }
}'

Alternatively, if you want some flexibility in finding records based on this field, you can keep this field analyzed and use text queries instead:

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "query": {
        "text": {
                "field": "update-time"
        }
    }
}'

Please, keep in mind that if your field is analyzed then this record will be found by searching for just word "update" or word "time" as well.

2
  • I was just going to add this as an answer. Thanks for the detail explanation.
    – Gabbar
    Commented Jul 19, 2012 at 18:50
  • 3
    Great answer. You might want to change the "text" to "match." Looked like elasticsearch deprecated text and replaced it with match.
    – RisingSun
    Commented Jan 20, 2016 at 18:58
52

The accepted answer didn't work for me with elastic 6.1. I solved it using the "keyword" field that elastic provides by default on string fields.

{
    "filter": {
            "term": {
                    "field.keyword": "update-time"
                }
        }
}
2
  • 2
    This worked for me, Changing the mapping would have meant that we have to create a new index. Thanks :)
    – nowRails
    Commented Dec 6, 2019 at 1:11
  • 2
    Confirming this works as of ES 7.12. Thank you! Commented Apr 19, 2021 at 12:36
1

Based on the answer by @imotov If you're using spring-data-elasticsearch then all you need to do is mark your field as:

@Field(type = FieldType.String, index = FieldIndex.not_analyzed)

instead of

@Field(type = FieldType.String)

The problem is you need to drop the index though and re-instantiate it with new mappings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.