Elasticsearch未返回所有相关结果

Question

I am using elastic search to search for files stored in MongoDB. I would like to retrieve all files whose name match a pattern. When I queried in MongoDB it returns 6754 files.

FSsearch:PRIMARY> db.fs.files.find({"filename":/.*Mail.*/}).count();

6754

But when I tried to do the same with elastic search it return only 85 files. Any way to get all the files in elastic search?

curl -XGET "localhost:9200/submission_idx/files/_search?search_type=scan&scroll=10m&size=7000&pretty=1" -d '{"query" : {
"field" : {
        "filename" : "*Mail*"
    }                           
}                            
}'

{
  "_scroll_id" : "c2Nhbjs1OzIyMDpDV21tamdEbVEyZUhOcVcwYWVnVU9ROzIxODpDV21tamdEbVEyZUhOcVcwYWVnVU9ROzIxNjpDV21tamdEbVEyZUhOcVcwYWVnVU9ROzIxOTpDV21tamdEbVEyZUhOcVcwYWVnVU9ROzIxNzpDV21tamdEbVEyZUhOcVcwYWVnVU9ROzE7dG90YWxfaGl0czo4NTs=",
  "took" : 8,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 85,
    "max_score" : 0.0,
    "hits" : [ ]
  }
}

Answer 1

You can use the Regexp Filter (or Regexp Query ):

{
    "filtered": {
        "query": {
            "match_all": {}
        },
        "filter": {
            "regexp":{
                "filename" : "*mail*"
            }
        }
    }
}

Notice the lower-case "m" on mail. By default, Elasticsearch analyzes all fields with a lower case tokenizer. Consequently, when searching for capitalized "Mail," Elasticsearch will exclude all analyzed fields from the returned results. You can turn the default lower-case tokenizer off by marking a field as "not_analyzed" or by creating your own custom analyzer.

Also, be aware that using wildcards, especially at the beginning of a query, can be very slow and memory-consuming when searching on large datasets.