13

I have a bunch of documents with an array field like this:

{ "feed_uids": ["math.CO", "cs.IT"] }

I would like to find all documents that contain some subset of these values i.e. treat them as tags. Documentation leads me to believe a terms filter should work:

{ "query": { "filtered": { "filter": { "terms": { "feed_uids": [ "cs.IT" ] } } } } }

However, the query matches nothing. What am I doing wrong?

2
  • If you're doing a terms filter the column you're trying to filter against should be analyzed. Is the feeds_uids field set to be analyzed? If so what analyzer is it using? Can you test what tokens are returned when passing the string cs.IT into the analyzer. You can test the analyzer's return data by doing the following: localhost:9200/{your index name}/_analyze?analyzer={your analyzer name}&text=cs.IT. Commented Mar 5, 2014 at 9:32
  • I have just run your text through the default snowball analyzer and gotten the following token response, {"tokens":[{"token":"cs.it","start_offset":0,"end_offset":5,"type":"<ALPHANUM>","position":1}]} so the tokenisation of your text seems to be correct, so the only other thing I can imagine is that your feed_uids field isn't set to analyze. Commented Mar 5, 2014 at 9:33

1 Answer 1

20

The terms-filter works as you expect. I guess your problem here is that you have a mapping where feed_uids is using the standard analyzer.

This is quite a common problem which is described in a bit more depth here: Troubleshooting Elasticsearch searches, for Beginners

Here is a runnable example showcasing how it works if you specify "index": "not_analyzed" for the field: https://www.found.no/play/gist/bc957d515597ec8262ab

#!/bin/bash

export ELASTICSEARCH_ENDPOINT="http://localhost:9200"

# Create indexes

curl -XPUT "$ELASTICSEARCH_ENDPOINT/play" -d '{
    "mappings": {
        "type": {
            "properties": {
                "feed_uids": {
                    "type": "string",
                    "index": "not_analyzed"
                }
            }
        }
    }
}'

# Index documents
curl -XPOST "$ELASTICSEARCH_ENDPOINT/_bulk?refresh=true" -d '
{"index":{"_index":"play","_type":"type"}}
{"feed_uids":["math.CO","cs.IT"]}
{"index":{"_index":"play","_type":"type"}}
{"feed_uids":["cs.IT"]}
'

# Do searches

curl -XPOST "$ELASTICSEARCH_ENDPOINT/_search?pretty" -d '
{
    "query": {
        "filtered": {
            "filter": {
                "terms": {
                    "feed_uids": [
                        "cs.IT"
                    ]
                }
            }
        }
    }
}
'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.