在弹性搜索中使用通配符进行部分搜索

Question

I want to search on array value in Elastic search using wildcard.

{
    "query": {
        "wildcard": {
            "short_message": {
                "value": "*nne*",
                "boost": 1.0,
                "rewrite": "constant_score"
            }
        }
    }
}

I am search on "short_messages", It's working for me. But I want to search on "messages.message" it's not working.

{
    "query": {
        "wildcard": {
            "messages.message": {
                "value": "*nne*",
                "boost": 1.0,
                "rewrite": "constant_score"
            }
        }
    }
}

And I also want to search for multiple fields in an array.

For Example:- fields: ["messages.message","messages.subject", "messages.email_search"]

It is possible then to give me the best solutions.

Thanks in Advance.

Answer 1

Seems like you are making used of nested datatype for messages .

You would need to make use of nested query for this:

POST <your_index_name>/_search
{
  "query": {
    "nested": {
      "path": "messages",
      "query": {
        "wildcard": {
          "messages.message": {
            "value": "*nne*",
            "boost": 1
          }
        }
      }
    }
  }
}

For multi-field querying, you can probably do it using query_string so basically your solution would be to make use of query_string inside a nested query .

Query String:

POST <your_index_name>/_search
{
  "query": {
    "nested": {
      "path": "messages",
      "query": {
        "query_string": {
          "fields": ["messages.message", "messages.subject"],
          "query": "*nne*",
          "boost": 1
        }
      }
    }
  }
}

Query DSL

You can also make use of wildcard using Query DSL but then again, you need to add multiple query clauses for every field, for performance reasons I suspect that wildcard queries doesn't support multi-field querying.

POST <your_index_name>/_search
{
  "query": {
    "nested": {
      "path": "messages",
      "query": {
        "bool": {
          "should": [
            {
              "wildcard": { 
                "messages.message": {
                  "value": "*nne*",
                  "boost": 1
                }
              }
            },
            {
              "wildcard": {
                "messages.subject": {
                  "value": "*nne*",
                  "boost": 1
                }
              }
            }
          ]
        }
      }
    }
  }
}

Note that wildcard search is not advisable because of the number of regex operations it has to do and would affect your latency to get a response, instead I would recommend you to look into Ngram Tokenizer thereby which you can make use of a simple match query to get your desired result.

Let me know if this helps!